1. What is the primary objective of ransomware?
A) To steal credit card data
B) To encrypt files and demand ransom for decryption
C) To install spyware on the victim’s machine
D) To crash the operating system
✅ Answer: B) To encrypt files and demand ransom for decryption
📝 Explanation: Ransomware is designed to encrypt a victim’s files or lock access to their system and then demand payment (usually in cryptocurrency) for decryption.
2. Which of the following is NOT a common method of ransomware distribution?
A) Phishing emails
B) Drive-by downloads
C) SQL Injection
D) Malvertising
✅ Answer: C) SQL Injection
📝 Explanation: While SQL Injection is a web attack used to steal data, ransomware is typically spread via phishing emails, drive-by downloads, and malicious ads (malvertising).
3. What encryption technique is most commonly used by modern ransomware?
A) ROT13
B) XOR Encoding
C) AES and RSA Encryption
D) Base64 Encoding
✅ Answer: C) AES and RSA Encryption
📝 Explanation: Modern ransomware uses AES (symmetric) and RSA (asymmetric) encryption to lock files and make them virtually impossible to decrypt without the attacker’s key.
4. What is the name of the infamous ransomware that crippled hospitals and businesses worldwide in 2017?
A) NotPetya
B) Wannacry
C) Locky
D) Bad Rabbit
✅ Answer: B) Wannacry
📝 Explanation: WannaCry was a self-propagating ransomware that exploited the EternalBlue vulnerability in Windows systems, infecting hundreds of thousands of computers worldwide.
5. How do attackers typically demand ransom payments?
A) Direct bank transfers
B) Bitcoin or other cryptocurrencies
C) Credit card transactions
D) PayPal payments
✅ Answer: B) Bitcoin or other cryptocurrencies
📝 Explanation: Cybercriminals prefer cryptocurrencies like Bitcoin because they offer anonymity, making it difficult to track payments.
6. Which type of ransomware completely locks the victim’s screen, preventing any usage?
A) Crypto ransomware
B) Scareware
C) Locker ransomware
D) Adware
✅ Answer: C) Locker ransomware
📝 Explanation: Locker ransomware locks the entire screen or device, preventing access to files or applications until a ransom is paid.
7. What is the best way to recover files after a ransomware attack?
A) Paying the ransom
B) Using a decryptor from the attacker
C) Restoring from a clean backup
D) Formatting the system
✅ Answer: C) Restoring from a clean backup
📝 Explanation: The safest method to recover encrypted files is to restore them from a secure backup. Paying the ransom does not guarantee file recovery.
8. What is double extortion in ransomware attacks?
A) Encrypting files and stealing data before demanding ransom
B) Using two different encryption algorithms
C) Sending multiple ransom demands
D) Attacking two victims simultaneously
✅ Answer: A) Encrypting files and stealing data before demanding ransom
📝 Explanation: In double extortion, hackers not only encrypt files but also steal sensitive data and threaten to leak it unless the ransom is paid.
9. Which security measure is MOST effective against ransomware?
A) Installing a VPN
B) Regular software updates & patching
C) Using incognito mode
D) Disabling JavaScript
✅ Answer: B) Regular software updates & patching
📝 Explanation: Keeping software up to date helps patch vulnerabilities that ransomware exploits, such as EternalBlue, which enabled WannaCry.
10. What is a Ransomware-as-a-Service (RaaS)?
A) A legitimate cloud service
B) A framework for ethical hacking
C) A criminal business model where ransomware is leased
D) A security tool for penetration testers
✅ Answer: C) A criminal business model where ransomware is leased
📝 Explanation: RaaS allows cybercriminals to rent or buy ransomware kits and launch attacks without technical expertise.
11. Which organization often provides free decryption tools for ransomware victims?
A) Microsoft
B) The FBI
C) No More Ransom Project
D) Google
✅ Answer: C) No More Ransom Project
📝 Explanation: The No More Ransom Project offers free decryption tools for certain ransomware strains to help victims recover files.
12. What should you NEVER do after being infected by ransomware?
A) Disconnect the infected machine
B) Report to authorities
C) Pay the ransom immediately
D) Check if decryption tools are available
✅ Answer: C) Pay the ransom immediately
📝 Explanation: Paying the ransom does not guarantee file recovery and encourages attackers to continue their operations.
13. What is the main delivery mechanism for ransomware in phishing emails?
A) PDF documents
B) Malicious macros in Office files
C) Fake social media links
D) Image attachments
✅ Answer: B) Malicious macros in Office files
📝 Explanation: Many ransomware attacks are delivered via Office documents containing macros that execute malware once enabled.
14. What role does the Dark Web play in ransomware attacks?
A) It hosts ransomware forums and sales
B) It helps victims recover files
C) It prevents ransomware attacks
D) It is used for law enforcement investigations
✅ Answer: A) It hosts ransomware forums and sales
📝 Explanation: The Dark Web is often used for selling ransomware, buying exploits, and laundering ransom payments.
15. What type of ransomware attack targeted Colonial Pipeline in 2021?
A) WannaCry
B) LockBit
C) DarkSide
D) Petya
✅ Answer: C) DarkSide
📝 Explanation: DarkSide ransomware disrupted fuel supply in the U.S. East Coast by targeting Colonial Pipeline.
16. What is a common technique used to stop ransomware infections?
A) Using strong passwords
B) Enabling auto-updates
C) Blocking executable files from unknown locations
D) Using multiple web browsers
✅ Answer: C) Blocking executable files from unknown locations
📝 Explanation: Ransomware often executes from unusual directories, and blocking these files can prevent infections.
17. What is the function of a ransomware kill switch?
A) It self-destructs ransomware after execution
B) It prevents ransomware from encrypting files
C) It deletes the victim’s data
D) It speeds up the encryption process
✅ Answer: B) It prevents ransomware from encrypting files
📝 Explanation: A kill switch is a mechanism (like in WannaCry) that stops ransomware from executing.
18. What is a major sign of a ransomware infection?
A) A sudden drop in network speed
B) Unresponsive web browsers
C) Files changing extensions
D) Increased battery consumption
✅ Answer: C) Files changing extensions
📝 Explanation: Ransomware often renames files with a unique extension (e.g., .locked, .crypz, .locky).
19. What is the primary reason why ransomware groups demand payment in cryptocurrency?
A) Cryptocurrencies are easier to convert to cash
B) Cryptocurrencies provide anonymity and are harder to trace
C) Cryptocurrencies are immune to government regulations
D) Cryptocurrencies are preferred by banks
✅ Answer: B) Cryptocurrencies provide anonymity and are harder to trace
📝 Explanation: Bitcoin and Monero are popular among cybercriminals because they make it difficult for law enforcement to track transactions.
20. What is the primary goal of “Scareware” in ransomware campaigns?
A) Encrypt files and demand a ransom
B) Trick victims into believing their system is infected
C) Completely disable the operating system
D) Spread malware to other networks
✅ Answer: B) Trick victims into believing their system is infected
📝 Explanation: Scareware presents fake security alerts, tricking users into downloading malware or paying for useless software.
21. Which of the following best describes “Triple Extortion” ransomware attacks?
A) Encrypting files, stealing data, and demanding payment from third parties
B) Encrypting files three times for stronger protection
C) Using three different attack vectors in one ransomware campaign
D) Demanding ransom in three different currencies
✅ Answer: A) Encrypting files, stealing data, and demanding payment from third parties
📝 Explanation: Triple extortion ransomware goes beyond encrypting files—it steals sensitive data and demands ransom from customers or partners of the victim organization.
22. What security measure is most effective in preventing ransomware propagation within a network?
A) Disabling Bluetooth
B) Segmenting the network
C) Installing multiple browsers
D) Using public Wi-Fi
✅ Answer: B) Segmenting the network
📝 Explanation: Network segmentation limits the spread of ransomware by isolating infected systems, reducing damage.
23. What is the main purpose of a ransomware “Command and Control” (C2) server?
A) To store ransomware source code
B) To manage the encryption keys and ransom transactions
C) To provide decryption tools
D) To help law enforcement track attackers
✅ Answer: B) To manage the encryption keys and ransom transactions
📝 Explanation: C2 servers send encryption keys, monitor infections, and handle ransom demands and payments.
24. How does a “wiper malware” differ from traditional ransomware?
A) It allows easy decryption after payment
B) It permanently destroys data instead of encrypting it
C) It spreads through USB devices only
D) It only targets government networks
✅ Answer: B) It permanently destroys data instead of encrypting it
📝 Explanation: Wiper malware erases files irreversibly, often used for destructive attacks instead of financial extortion.
25. Which ransomware attack method involves exploiting Remote Desktop Protocol (RDP) vulnerabilities?
A) Malvertising
B) Brute-force RDP attacks
C) Watering hole attacks
D) DNS poisoning
✅ Answer: B) Brute-force RDP attacks
📝 Explanation: Attackers use brute-force attacks on weak RDP credentials to gain access and install ransomware.
26. What is the main function of an “Initial Access Broker” (IAB) in ransomware attacks?
A) To develop ransomware software
B) To sell compromised network access to ransomware groups
C) To provide antivirus solutions
D) To decrypt ransomware files
✅ Answer: B) To sell compromised network access to ransomware groups
📝 Explanation: IABs sell pre-compromised network access to ransomware gangs, facilitating large-scale attacks.
27. How do ransomware gangs commonly launder ransom payments?
A) By converting funds into gift cards
B) Through cryptocurrency tumbling/mixing services
C) By depositing money in Swiss banks
D) By using online casino transactions
✅ Answer: B) Through cryptocurrency tumbling/mixing services
📝 Explanation: Tumbling services obfuscate Bitcoin transactions, making it harder to trace ransom payments.
28. What is the best strategy to prevent zero-day ransomware exploits?
A) Disable antivirus software
B) Rely only on firewalls
C) Implement behavior-based threat detection
D) Use outdated software
✅ Answer: C) Implement behavior-based threat detection
📝 Explanation: Behavior-based detection identifies ransomware activity before execution, unlike traditional signature-based defenses.
29. Which popular Linux-based ransomware strain targets enterprise networks?
A) Ryuk
B) Conti
C) RansomEXX
D) Petya
✅ Answer: C) RansomEXX
📝 Explanation: RansomEXX is a Linux-focused ransomware targeting enterprise networks and cloud environments.
30. What is “Time-Bomb Ransomware”?
A) A ransomware that encrypts files after a set delay
B) A ransomware that self-destructs after payment
C) A type of wiper malware
D) A ransomware that can be defused by antivirus software
✅ Answer: A) A ransomware that encrypts files after a set delay
📝 Explanation: Time-bomb ransomware stays dormant for days or weeks before activating, making detection harder.
31. What is a ransomware gang’s primary tactic to increase pressure on victims?
A) Calling the police
B) Threatening to expose stolen data (double extortion)
C) Offering free decryptors
D) Reducing ransom amounts
✅ Answer: B) Threatening to expose stolen data (double extortion)
📝 Explanation: Double extortion tactics force victims to pay ransom by threatening to leak stolen data.
32. Which of the following is an advanced ransomware infection vector?
A) SQL Injection
B) Supply Chain Attacks
C) DDoS Attacks
D) Bluetooth Spoofing
✅ Answer: B) Supply Chain Attacks
📝 Explanation: Supply chain ransomware spreads via compromised software updates (e.g., Kaseya VSA attack).
33. How does “Polymorphic Ransomware” evade detection?
A) By frequently changing its code
B) By only infecting offline systems
C) By blocking antivirus updates
D) By hiding in images
✅ Answer: A) By frequently changing its code
📝 Explanation: Polymorphic ransomware modifies its code constantly to evade antivirus detection.
34. What is the purpose of “Sinkholing” in ransomware mitigation?
A) To neutralize malicious domains used by ransomware
B) To store ransomware variants in a secure environment
C) To generate fake ransom payments
D) To disable internet connections
✅ Answer: A) To neutralize malicious domains used by ransomware
📝 Explanation: Sinkholing redirects malicious C2 traffic to prevent communication with attackers.
35. How does “Human-Operated Ransomware” differ from automated ransomware?
A) It relies on targeted, manual intrusion techniques
B) It self-propagates via worms
C) It spreads only through mobile apps
D) It does not demand a ransom
✅ Answer: A) It relies on targeted, manual intrusion techniques
📝 Explanation: Human-operated ransomware attacks involve manual hacking techniques before deploying ransomware.
35. What is the main role of an “affiliate” in a Ransomware-as-a-Service (RaaS) model?
A) Develop ransomware from scratch
B) Distribute ransomware in exchange for a share of ransom payments
C) Provide technical support to victims
D) Manage ransom payments on behalf of attackers
✅ Answer: B) Distribute ransomware in exchange for a share of ransom payments
📝 Explanation: Affiliates in RaaS are cybercriminals who distribute ransomware and receive a percentage of the ransom.
36. What type of malware is commonly paired with ransomware to maximize damage?
A) Keyloggers
B) Adware
C) Spyware
D) Rootkits
✅ Answer: D) Rootkits
📝 Explanation: Rootkits allow attackers to maintain persistence on infected systems, making ransomware removal more difficult.
37. How does “fileless ransomware” evade detection?
A) By deleting system logs
B) By running only in memory without leaving files on disk
C) By using fake error messages
D) By renaming encrypted files
✅ Answer: B) By running only in memory without leaving files on disk
📝 Explanation: Fileless ransomware operates entirely in RAM, bypassing traditional antivirus scans that check stored files.
38. What is the purpose of “living off the land” techniques in ransomware attacks?
A) To blend malicious activity with legitimate system processes
B) To launch ransomware from removable drives
C) To create duplicate system backups
D) To host ransomware payloads on legitimate cloud storage
✅ Answer: A) To blend malicious activity with legitimate system processes
📝 Explanation: Attackers use built-in system tools (like PowerShell) to execute ransomware without dropping new malware files.
39. Which ransomware gang was responsible for the attack on JBS (the world’s largest meat processor) in 2021?
A) REvil
B) Ryuk
C) Maze
D) Conti
✅ Answer: A) REvil
📝 Explanation: REvil ransomware attacked JBS in 2021, disrupting global meat supply chains.
40. What is “locker ransomware” primarily designed to do?
A) Encrypt files only
B) Lock the entire system and prevent access to the desktop
C) Steal credentials from browsers
D) Modify user account permissions
✅ Answer: B) Lock the entire system and prevent access to the desktop
📝 Explanation: Locker ransomware blocks user access to the whole system, unlike crypto-ransomware, which targets files.
41. How do attackers bypass Multi-Factor Authentication (MFA) in ransomware attacks?
A) Using brute-force attacks
B) Exploiting MFA fatigue attacks
C) Sending a phishing email with an infected attachment
D) Using outdated VPN software
✅ Answer: B) Exploiting MFA fatigue attacks
📝 Explanation: MFA fatigue attacks involve bombarding victims with MFA requests until they approve one.
42. How does “double encryption” ransomware increase complexity for victims?
A) Encrypts files twice using different algorithms
B) Uses two separate ransom payments
C) Encrypts files and system logs
D) Encrypts files only but hides ransom notes
✅ Answer: A) Encrypts files twice using different algorithms
📝 Explanation: Double encryption ransomware applies multiple layers of encryption, making recovery even harder.
43. What is the primary reason why ransomware gangs target hospitals?
A) Hospitals have weak security
B) Patient data is highly valuable and downtime is critical
C) Ransomware is easier to deploy on medical devices
D) Medical staff are not trained in cybersecurity
✅ Answer: B) Patient data is highly valuable and downtime is critical
📝 Explanation: Healthcare organizations are prime targets because they cannot afford downtime, increasing ransom payment likelihood.
44. What security control can prevent ransomware from spreading laterally within a network?
A) Using strong passwords
B) Enforcing network segmentation
C) Increasing storage capacity
D) Encrypting email communications
✅ Answer: B) Enforcing network segmentation
📝 Explanation: Network segmentation limits the impact of ransomware by preventing its spread across different systems.
45. What is the purpose of a “cryptographic key vault” in ransomware attacks?
A) To securely store encryption keys
B) To manage user credentials
C) To store malware payloads
D) To generate random filenames
✅ Answer: A) To securely store encryption keys
📝 Explanation: Attackers often use key vaults to store and manage encryption keys, making decryption difficult.
46. Which programming language is commonly used to develop ransomware?
A) Python
B) C++
C) GoLang
D) All of the above
✅ Answer: D) All of the above
📝 Explanation: Ransomware developers use multiple languages, including Python, C++, and GoLang, for stealth and performance.
47. Which attack technique involves forcing a user to execute ransomware by tricking them into clicking something?
A) Watering hole attack
B) Clickjacking
C) SQL injection
D) Directory traversal
✅ Answer: B) Clickjacking
📝 Explanation: Clickjacking hides malicious links under legitimate ones, tricking users into activating malware.
48. What ransomware tactic involves attackers contacting victims directly to pressure them into paying?
A) Data encryption
B) Ransom negotiation
C) Cold calling victims
D) Extortion calls
✅ Answer: C) Cold calling victims
📝 Explanation: Some ransomware groups call victims to increase pressure and demand immediate payments.
49. What does “ransomware readiness assessment” help organizations do?
A) Evaluate vulnerability to ransomware attacks
B) Improve software performance
C) Speed up ransomware encryption
D) Train employees on phishing emails
✅ Answer: A) Evaluate vulnerability to ransomware attacks
📝 Explanation: A ransomware readiness assessment helps organizations identify weaknesses and improve defenses.
50. How do attackers use “exfiltration” in ransomware attacks?
A) To encrypt files twice
B) To transfer stolen data before encrypting files
C) To inject SQL queries
D) To create backdoors
✅ Answer: B) To transfer stolen data before encrypting files
📝 Explanation: Exfiltration involves stealing sensitive data before encrypting it for double extortion.
51. What is the best method to stop ransomware from launching in a corporate environment?
A) Disable all external devices
B) Use an air-gapped backup system
C) Delete system logs
D) Enable guest accounts
✅ Answer: B) Use an air-gapped backup system
📝 Explanation: Air-gapped backups are physically separated from networks, preventing ransomware from accessing them.
52. What is a “Ransomware Red Team Exercise”?
A) An ethical hacking test to simulate ransomware attacks
B) A government operation against ransomware groups
C) A method to spread ransomware faster
D) A negotiation strategy for paying ransom
✅ Answer: A) An ethical hacking test to simulate ransomware attacks
📝 Explanation: Red team exercises help organizations test their ability to detect and respond to ransomware threats.
53. What is a “kill chain” in ransomware attacks?
A) A series of steps attackers take to execute a ransomware attack
B) A command used to delete files
C) A type of cryptographic key
D) A method to break ransomware encryption
✅ Answer: A) A series of steps attackers take to execute a ransomware attack
📝 Explanation: The kill chain outlines the phases of an attack, from initial access to ransom demand.
54. What is a “partial encryption” ransomware attack?
A) A ransomware attack that only encrypts small portions of files
B) A ransomware attack that partially damages the system before execution
C) A ransomware attack that encrypts only system logs
D) A ransomware attack that encrypts only one directory
✅ Answer: A) A ransomware attack that only encrypts small portions of files
📝 Explanation: Partial encryption allows ransomware to encrypt only parts of large files, making the attack faster while still rendering files unusable.
55. What is a “time-delayed” ransomware attack?
A) A ransomware attack that encrypts files gradually over time
B) A ransomware attack that executes only after a certain period
C) A ransomware attack that spreads only during system updates
D) A ransomware attack that targets specific industries at a given time
✅ Answer: B) A ransomware attack that executes only after a certain period
📝 Explanation: Time-delayed ransomware remains dormant and activates after a set time, making detection and response more difficult.
56. How do ransomware gangs use “bulletproof hosting” services?
A) To store stolen data and host ransomware operations securely
B) To protect organizations from ransomware attacks
C) To block antivirus software
D) To distribute fake security updates
✅ Answer: A) To store stolen data and host ransomware operations securely
📝 Explanation: Bulletproof hosting providers offer anonymous and untraceable hosting services that cybercriminals use for ransomware C2 servers.
57. What is the role of “TTPs” (Tactics, Techniques, and Procedures) in ransomware defense?
A) They help organizations understand attacker behavior
B) They slow down ransomware encryption
C) They create fake ransomware alerts
D) They detect legal ransomware activity
✅ Answer: A) They help organizations understand attacker behavior
📝 Explanation: TTPs help security teams identify and stop ransomware attacks by analyzing hacker strategies.
58. How do attackers use “credential stuffing” in ransomware attacks?
A) By trying stolen usernames and passwords to gain access
B) By encrypting only credential-related files
C) By infecting databases with ransomware
D) By sending fake credential reset emails
✅ Answer: A) By trying stolen usernames and passwords to gain access
📝 Explanation: Credential stuffing involves using leaked passwords from breaches to access accounts and deploy ransomware.
59. What ransomware variant targeted the Irish healthcare system in 2021?
A) Ryuk
B) Conti
C) Maze
D) LockBit
✅ Answer: B) Conti
📝 Explanation: Conti ransomware caused severe disruption in the Irish healthcare system, impacting patient care.
60. What is the key weakness of symmetric encryption used in ransomware?
A) The key can be brute-forced easily
B) It uses too much processing power
C) The same key is used for encryption and decryption
D) It is outdated and no longer used
✅ Answer: C) The same key is used for encryption and decryption
📝 Explanation: In symmetric encryption, the same key is used to encrypt and decrypt, making it easier to recover files if the key is exposed.
61. How does “Ransomware-as-a-Service” (RaaS) benefit cybercriminals?
A) It allows non-technical attackers to launch ransomware attacks
B) It provides free cybersecurity training
C) It enables companies to recover files faster
D) It stops ransomware from spreading
✅ Answer: A) It allows non-technical attackers to launch ransomware attacks
📝 Explanation: RaaS provides ready-made ransomware kits, enabling even non-experts to deploy attacks.
62. What is a “bogus ransomware” attack?
A) A ransomware attack that does not actually encrypt files
B) A ransomware attack that deletes files instead of encrypting them
C) A ransomware attack that infects only virtual machines
D) A ransomware attack that is executed via DNS poisoning
✅ Answer: A) A ransomware attack that does not actually encrypt files
📝 Explanation: Some fake ransomware displays ransom demands without encrypting anything, tricking victims into paying.
63. Which type of backup is safest against ransomware attacks?
A) Cloud backup only
B) Local backup on the same machine
C) Air-gapped and immutable backups
D) USB backup connected to the network
✅ Answer: C) Air-gapped and immutable backups
📝 Explanation: Air-gapped backups are physically isolated from networks, making them immune to ransomware attacks.
64. What is “ransomware affiliate profit sharing”?
A) Ransomware groups giving discounts to victims
B) A reward program for companies that pay ransom
C) A system where RaaS affiliates receive a percentage of ransom payments
D) A legal strategy for ransomware negotiations
✅ Answer: C) A system where RaaS affiliates receive a percentage of ransom payments
📝 Explanation: Ransomware affiliates distribute malware and receive a cut (often 60-80%) of the ransom.
65. How do attackers use “DLL Sideloading” in ransomware?
A) By hijacking legitimate Windows processes to execute ransomware
B) By modifying Linux kernel modules
C) By injecting ransomware into mobile applications
D) By encrypting DLL files before executables
✅ Answer: A) By hijacking legitimate Windows processes to execute ransomware
📝 Explanation: DLL sideloading exploits trusted applications to execute ransomware without detection.
66. What is a “honeypot” in ransomware defense?
A) A fake target designed to lure and detect ransomware
B) A backup storage solution
C) A decryption tool for ransomware
D) A high-speed encryption method
✅ Answer: A) A fake target designed to lure and detect ransomware
📝 Explanation: Honeypots are decoy systems that trick ransomware into revealing its tactics.
67. Why is Monero (XMR) often used instead of Bitcoin in ransomware payments?
A) It has faster transaction speeds
B) It is untraceable and offers better anonymity
C) It is easier to mine
D) It is widely accepted by banks
✅ Answer: B) It is untraceable and offers better anonymity
📝 Explanation: Monero (XMR) is a privacy-focused cryptocurrency that makes transactions almost impossible to trace.
68. What is “key stretching” in ransomware encryption?
A) A technique to slow down brute-force attacks on encryption keys
B) A method for storing decryption keys
C) A way to spread ransomware faster
D) A type of brute-force attack
✅ Answer: A) A technique to slow down brute-force attacks on encryption keys
📝 Explanation: Key stretching makes brute-force attacks harder by adding complexity to encryption keys.
69. What was the first known ransomware attack?
A) WannaCry
B) CryptoLocker
C) AIDS Trojan (PC Cyborg)
D) LockBit
✅ Answer: C) AIDS Trojan (PC Cyborg)
📝 Explanation: The AIDS Trojan (PC Cyborg) in 1989 was the first known ransomware, demanding payments via postal mail.
70. What is the main weakness of ransomware relying on offline encryption?
A) The encryption key might be stored locally
B) It requires an internet connection
C) It can be detected easily by firewalls
D) It cannot encrypt large files
✅ Answer: A) The encryption key might be stored locally
📝 Explanation: Offline ransomware may store encryption keys on the infected device, allowing decryption without paying ransom.
71. What is the main advantage of using an Incident Response Plan (IRP) against ransomware attacks?
A) It guarantees ransomware attacks won’t happen
B) It provides a structured approach for detecting, containing, and mitigating attacks
C) It allows companies to pay the ransom faster
D) It replaces the need for cybersecurity software
✅ Answer: B) It provides a structured approach for detecting, containing, and mitigating attacks
📝 Explanation: An IRP helps organizations quickly respond to ransomware incidents and reduce damage.
72. Which type of attack is often combined with ransomware to maximize impact?
A) Phishing
B) DDoS (Distributed Denial of Service)
C) Credential stuffing
D) All of the above
✅ Answer: D) All of the above
📝 Explanation: Attackers often combine DDoS, phishing, and credential stuffing with ransomware for greater disruption.
73. What is the purpose of “data exfiltration” in modern ransomware attacks?
A) To encrypt data faster
B) To create an untraceable backdoor
C) To steal sensitive data before encryption and use it for extortion
D) To execute ransomware without being detected
✅ Answer: C) To steal sensitive data before encryption and use it for extortion
📝 Explanation: Data exfiltration enables double extortion where attackers leak stolen data if ransom isn’t paid.
74. What is the purpose of “ransomware negotiation services”?
A) To negotiate with law enforcement
B) To help victims reduce ransom amounts and explore alternatives
C) To hack into ransomware servers
D) To encrypt data before attackers do
✅ Answer: B) To help victims reduce ransom amounts and explore alternatives
📝 Explanation: Some cybersecurity firms offer ransomware negotiation services to help lower ransom demands or find ways to recover data without paying.
75. What role does the MITRE ATT&CK framework play in ransomware defense?
A) It helps track ransomware payments
B) It classifies cyberattacks, including ransomware techniques
C) It provides software updates to prevent ransomware
D) It decrypts ransomware-affected files
✅ Answer: B) It classifies cyberattacks, including ransomware techniques
📝 Explanation: MITRE ATT&CK provides a detailed framework of tactics used in ransomware and other cyber threats.
76. What is the function of a “kill switch” in some ransomware variants?
A) It self-destructs the ransomware after execution
B) It stops the ransomware if certain conditions are met
C) It speeds up the encryption process
D) It prevents victims from paying the ransom
✅ Answer: B) It stops the ransomware if certain conditions are met
📝 Explanation: Some ransomware, like WannaCry, had a kill switch that stopped infections when it connected to a specific domain.
77. What is “Geo-Locking” in ransomware attacks?
A) Preventing infections in specific countries
B) Encrypting only geographic-based data
C) Attacking only cloud-based networks
D) Limiting ransomware to certain file types
✅ Answer: A) Preventing infections in specific countries
📝 Explanation: Many ransomware groups geo-lock attacks to avoid infecting their home countries to reduce legal risks.
78. Which of the following is an example of “human-operated” ransomware?
A) TrickBot
B) Ryuk
C) Emotet
D) QakBot
✅ Answer: B) Ryuk
📝 Explanation: Ryuk ransomware is human-operated, meaning attackers manually navigate networks before deploying encryption.
79. How do attackers use “MFA fatigue” in ransomware campaigns?
A) By overwhelming a user with continuous MFA requests until they approve one
B) By disabling MFA entirely
C) By forcing users to reset their passwords
D) By sending fake MFA codes
✅ Answer: A) By overwhelming a user with continuous MFA requests until they approve one
📝 Explanation: MFA fatigue attacks repeatedly prompt users for MFA approval, hoping they accidentally approve a login request.
80. What is a “smash-and-grab” ransomware attack?
A) A rapid attack that encrypts and exfiltrates data in a short period
B) A ransomware attack that destroys files instead of encrypting them
C) A ransomware attack that targets only mobile devices
D) A slow-moving ransomware attack that avoids detection
✅ Answer: A) A rapid attack that encrypts and exfiltrates data in a short period
📝 Explanation: “Smash-and-grab” attacks quickly deploy ransomware to maximize damage before detection.
81. Why do some ransomware gangs fake their own shutdowns?
A) To avoid prosecution while rebranding under a different name
B) To claim innocence and erase evidence
C) To confuse cybersecurity researchers
D) To reduce the effectiveness of security tools
✅ Answer: A) To avoid prosecution while rebranding under a different name
📝 Explanation: Many ransomware gangs “shutdown” and reappear under new names to evade law enforcement.
82. What is “island hopping” in ransomware attacks?
A) Using third-party vendors to attack larger organizations
B) Encrypting only parts of a victim’s data
C) Attacking multiple unrelated victims in succession
D) Hopping between different file types
✅ Answer: A) Using third-party vendors to attack larger organizations
📝 Explanation: Island hopping occurs when attackers compromise a small vendor to reach a larger company.
83. What makes Linux ransomware attacks different from Windows attacks?
A) They use a different encryption algorithm
B) They often target servers and cloud environments
C) They only encrypt log files
D) They require root access
✅ Answer: B) They often target servers and cloud environments
📝 Explanation: Linux ransomware attacks focus on enterprise cloud infrastructure and critical systems.
84. How do ransomware groups use “deepfake audio” in attacks?
A) To impersonate executives and authorize fund transfers
B) To spread ransomware via voice messages
C) To replace ransom notes with fake audio messages
D) To mimic antivirus alerts
✅ Answer: A) To impersonate executives and authorize fund transfers
📝 Explanation: Deepfake audio has been used to trick employees into transferring money to ransomware groups.
85. How do “wiper malware” and ransomware differ?
A) Wiper malware destroys data, while ransomware encrypts it for ransom
B) Wiper malware demands a higher ransom
C) Wiper malware targets mobile devices only
D) Wiper malware restores files after payment
✅ Answer: A) Wiper malware destroys data, while ransomware encrypts it for ransom
📝 Explanation: Wiper malware is designed to permanently destroy data, often used in nation-state attacks.
86. What is a “ransomware dropper”?
A) A lightweight malware that downloads and executes ransomware
B) A tool used to decrypt ransomware files
C) A type of phishing attack
D) A ransomware variant that attacks cloud systems
✅ Answer: A) A lightweight malware that downloads and executes ransomware
📝 Explanation: Droppers are small malware that fetch ransomware payloads from remote servers.
87. How do “polymorphic ransomware” variants evade detection?
A) By changing their code every time they execute
B) By spreading only through local networks
C) By disabling firewalls
D) By encrypting only half the data
✅ Answer: A) By changing their code every time they execute
📝 Explanation: Polymorphic ransomware modifies itself to avoid antivirus signature detection.
88. What is “Ransom DoS” (RDoS) in cyberattacks?
A) A Distributed Denial-of-Service (DDoS) attack with a ransom demand
B) A ransomware attack that targets only cloud services
C) A ransomware variant that deletes files instead of encrypting them
D) A ransomware attack that exploits Bluetooth vulnerabilities
✅ Answer: A) A Distributed Denial-of-Service (DDoS) attack with a ransom demand
📝 Explanation: Ransom DoS (RDoS) attacks involve threatening or executing a DDoS attack unless a ransom is paid.
89. Which attack vector is most commonly used for delivering ransomware to corporate networks?
A) Bluetooth exploits
B) Phishing emails with malicious attachments
C) Physical access to servers
D) Social media ads
✅ Answer: B) Phishing emails with malicious attachments
📝 Explanation: Phishing emails containing infected attachments or malicious links are the most common method for delivering ransomware.
90. What does “Ransom Cartel” refer to in ransomware attacks?
A) A group of ransomware gangs collaborating for larger attacks
B) A government task force to stop ransomware
C) A name for fake ransomware warnings
D) A ransomware strain targeting underground markets
✅ Answer: A) A group of ransomware gangs collaborating for larger attacks
📝 Explanation: Ransom Cartel refers to ransomware gangs working together, sharing resources, and refining attack techniques.
91. Why do some ransomware operators perform “proof-of-life” demonstrations?
A) To prove they have the decryption key before a ransom is paid
B) To guarantee victims that their data won’t be leaked
C) To test their ransomware before a full-scale attack
D) To create decoy ransom demands
✅ Answer: A) To prove they have the decryption key before a ransom is paid
📝 Explanation: Attackers decrypt a small sample of files to prove they can unlock the victim’s data, increasing the chance of payment.
92. What is the primary goal of “stealth ransomware”?
A) To remain undetected as long as possible before encryption
B) To encrypt only temporary files
C) To delete all security logs immediately
D) To ask for multiple ransom payments over time
✅ Answer: A) To remain undetected as long as possible before encryption
📝 Explanation: Stealth ransomware stays hidden, avoiding detection by disabling security tools and monitoring user activity before encryption.
93. What is the main weakness of relying solely on signature-based antivirus to detect ransomware?
A) It slows down encryption
B) It cannot detect new, unknown ransomware variants
C) It increases network traffic
D) It prevents all types of ransomware attacks
✅ Answer: B) It cannot detect new, unknown ransomware variants
📝 Explanation: Signature-based antivirus relies on predefined malware patterns, making it ineffective against zero-day ransomware.
94. What is the benefit of using a “canary file” in ransomware detection?
A) It acts as a decoy to trigger an alert if encrypted
B) It stores backup decryption keys
C) It speeds up data recovery
D) It automatically removes ransomware files
✅ Answer: A) It acts as a decoy to trigger an alert if encrypted
📝 Explanation: Canary files are fake documents placed in systems; if encrypted, they signal an active ransomware attack.
95. What is “Ransomcloud” ransomware?
A) A ransomware strain that specifically targets cloud services
B) A backup solution against ransomware
C) A tool used by security researchers
D) A ransomware attack that only affects mobile devices
✅ Answer: A) A ransomware strain that specifically targets cloud services
📝 Explanation: Ransomcloud is a type of ransomware that encrypts cloud-stored data, including services like OneDrive and Google Drive.
96. What is the purpose of “malware obfuscation” in ransomware development?
A) To hide malicious code from detection tools
B) To slow down the encryption process
C) To create duplicate copies of encrypted files
D) To trick victims into thinking their data is recovered
✅ Answer: A) To hide malicious code from detection tools
📝 Explanation: Obfuscation techniques make malware harder to detect by modifying its code structure without changing its behavior.
97. What is the major risk of paying the ransom in a ransomware attack?
A) Law enforcement might trace the payment
B) Attackers might demand a second payment
C) The payment might not result in file decryption
D) Both B and C
✅ Answer: D) Both B and C
📝 Explanation: Paying the ransom does not guarantee file recovery, and some attackers may demand additional payments.
98. What is a common sign of an active ransomware attack on a network?
A) A sudden spike in CPU usage
B) Files with new, unusual extensions
C) Unusual outbound network traffic
D) All of the above
✅ Answer: D) All of the above
📝 Explanation: Signs of an active ransomware attack include high CPU usage, files with changed extensions, and suspicious network activity.
99. What is the role of “sandboxing” in ransomware protection?
A) It isolates and analyzes suspicious files in a secure environment
B) It automatically encrypts files before ransomware can
C) It hides user data from ransomware attacks
D) It speeds up encryption for secure storage
✅ Answer: A) It isolates and analyzes suspicious files in a secure environment
📝 Explanation: Sandboxing runs suspicious files in a contained environment, preventing ransomware from infecting real systems.
100. What is a “whitelist-based” ransomware protection approach?
A) Allowing only trusted applications to execute, blocking unknown ones
B) Identifying and blocking known ransomware files
C) Encrypting all files in advance to prevent ransomware attacks
D) Detecting ransomware using behavioral analytics
✅ Answer: A) Allowing only trusted applications to execute, blocking unknown ones
📝 Explanation: Whitelisting prevents unauthorized software from running, stopping ransomware from executing in the first place.
101. What is “Ransomware Reinfection”?
A) When a system is infected with ransomware multiple times due to incomplete removal
B) When a victim accidentally downloads a different type of ransomware
C) When a ransomware attack spreads to multiple devices at once
D) When attackers refund the ransom and then attack again
✅ Answer: A) When a system is infected with ransomware multiple times due to incomplete removal
📝 Explanation: Ransomware can reinfect a system if remnants of the malware or vulnerabilities remain unpatched.
102. How does “multi-stage ransomware” increase the effectiveness of an attack?
A) It executes in multiple phases, such as initial access, data theft, and encryption
B) It only encrypts data in small increments
C) It creates fake ransomware alerts before launching the real attack
D) It spreads to IoT devices before encrypting files
✅ Answer: A) It executes in multiple phases, such as initial access, data theft, and encryption
📝 Explanation: Multi-stage ransomware first steals data, then deploys encryption, and finally demands ransom.
103. What is “Ransomware Data Auctioning”?
A) Selling stolen data on the dark web to the highest bidder
B) Selling decryption keys to cybersecurity firms
C) Offering victims a discount on ransom payments
D) Allowing multiple attackers to control the same ransomware
✅ Answer: A) Selling stolen data on the dark web to the highest bidder
📝 Explanation: Some ransomware groups auction stolen data to competitors, increasing pressure on victims.
104. What is the best way to prevent “Initial Access Brokers” (IABs) from selling network access to ransomware gangs?
A) Using strong password policies and multi-factor authentication (MFA)
B) Paying the ransom quickly
C) Disabling firewalls temporarily
D) Relying on antivirus software alone
✅ Answer: A) Using strong password policies and multi-factor authentication (MFA)
📝 Explanation: IABs sell compromised network credentials on the dark web; MFA and strong passwords reduce their effectiveness.
105. What is “Portable Executable (PE) Injection” in ransomware attacks?
A) Injecting malicious code into legitimate system processes
B) Encrypting files directly from USB devices
C) Disabling antivirus using registry modifications
D) Executing ransomware only in safe mode
✅ Answer: A) Injecting malicious code into legitimate system processes
📝 Explanation: PE Injection allows ransomware to run within trusted processes, evading detection.
106. Why do some ransomware gangs issue “customer service” to victims?
A) To help victims pay ransom and decrypt files smoothly
B) To assist law enforcement in tracking payments
C) To help cybersecurity experts find vulnerabilities
D) To prevent future infections
✅ Answer: A) To help victims pay ransom and decrypt files smoothly
📝 Explanation: Some ransomware operators provide customer support to increase ransom payments.
107. What is the purpose of “Session Hijacking” in ransomware deployment?
A) Gaining control of active user sessions to spread ransomware
B) Disrupting VPN connections to create security gaps
C) Encrypting cookies stored in browsers
D) Infecting only administrator accounts
✅ Answer: A) Gaining control of active user sessions to spread ransomware
📝 Explanation: Attackers use session hijacking to bypass authentication and deliver ransomware payloads.
108. How do ransomware operators use “smishing” in attacks?
A) Sending malicious links or attachments via SMS messages
B) Infecting smartwatches and wearables
C) Using email phishing on social media platforms
D) Encrypting only mobile contacts
✅ Answer: A) Sending malicious links or attachments via SMS messages
📝 Explanation: Smishing (SMS phishing) tricks victims into downloading ransomware via text messages.
109. Why do some ransomware attacks target NAS (Network Attached Storage) devices?
A) NAS devices store backups, making them valuable targets
B) NAS devices cannot be encrypted
C) NAS devices lack internet access
D) NAS devices have built-in ransomware protection
✅ Answer: A) NAS devices store backups, making them valuable targets
📝 Explanation: Attackers encrypt NAS devices to destroy backups and force ransom payments.
110. How does “Encrypted Payload Staging” improve ransomware stealth?
A) The ransomware payload remains encrypted until execution
B) The ransomware encrypts itself before infecting files
C) The ransomware only activates on weekends
D) The ransomware spreads through Wi-Fi networks only
✅ Answer: A) The ransomware payload remains encrypted until execution
📝 Explanation: Encrypted payload staging prevents antivirus detection by keeping the malware hidden until execution.
111. What is the role of “Reflective DLL Injection” in ransomware attacks?
A) Running malicious DLLs directly in memory without leaving traces
B) Encrypting DLL files before executables
C) Infecting only Linux-based operating systems
D) Encrypting logs in SIEM tools
✅ Answer: A) Running malicious DLLs directly in memory without leaving traces
📝 Explanation: Reflective DLL Injection allows ransomware to run without being stored on disk, making it harder to detect.
112. What is “Honey Encryption” in ransomware defense?
A) A method of encrypting fake data to mislead attackers
B) Encrypting ransomware files to make them unusable
C) A security strategy that relies on machine learning
D) Encrypting ransomware operators’ Bitcoin wallets
✅ Answer: A) A method of encrypting fake data to mislead attackers
📝 Explanation: Honey Encryption generates false decryption keys, making stolen data useless to attackers.
113. Why do some ransomware groups offer “trial decryption”?
A) To convince victims that decryption is possible if they pay
B) To test their own ransomware before launching attacks
C) To verify the victim’s financial status
D) To distract law enforcement
✅ Answer: A) To convince victims that decryption is possible if they pay
📝 Explanation: Attackers decrypt a small portion of files to increase the likelihood of payment.
114. What is the function of “Process Hollowing” in ransomware attacks?
A) Injecting malicious code into legitimate processes to avoid detection
B) Encrypting only system-critical processes
C) Using zero-day vulnerabilities in cloud computing
D) Exploiting password managers
✅ Answer: A) Injecting malicious code into legitimate processes to avoid detection
📝 Explanation: Process Hollowing enables ransomware to hide within trusted system processes, bypassing security tools.
115. Why do ransomware groups use Tor-based websites for ransom payments?
A) To prevent tracking by law enforcement
B) To provide a user-friendly payment method
C) To lower ransom transaction fees
D) To infect more victims
✅ Answer: A) To prevent tracking by law enforcement
📝 Explanation: Tor (The Onion Router) allows ransomware groups to operate anonymously, avoiding law enforcement detection.
116. What is “Killware,” and how is it different from ransomware?
A) Malware designed to cause physical harm, not just encrypt data
B) A ransomware variant that only targets government agencies
C) A self-destructive ransomware attack
D) A ransomware attack that deletes all data after encryption
✅ Answer: A) Malware designed to cause physical harm, not just encrypt data
📝 Explanation: Killware targets critical infrastructure, aiming to cause real-world harm, not just demand ransom.
117. What is “Zero-Day Ransomware”?
A) A ransomware attack that exploits an unknown vulnerability before a patch is available
B) A ransomware variant that encrypts files immediately without warning
C) A ransomware attack that self-destructs after 24 hours
D) A ransomware type that targets only cloud-based services
✅ Answer: A) A ransomware attack that exploits an unknown vulnerability before a patch is available
📝 Explanation: Zero-day ransomware attacks exploit previously unknown security flaws, making them difficult to detect and prevent.
118. What is “Automated Ransomware Negotiation”?
A) AI-driven bots that negotiate ransom amounts on behalf of victims
B) A ransomware technique that changes ransom demands based on victim’s income
C) A system that law enforcement uses to delay ransomware payments
D) A cryptocurrency tracking method used to trace ransom payments
✅ Answer: A) AI-driven bots that negotiate ransom amounts on behalf of victims
📝 Explanation: Some ransomware groups use AI-powered negotiation bots to automate ransom discussions and increase payment likelihood.
119. How do attackers use “Hypervisor-Level Ransomware”?
A) By targeting virtual machines and encrypting them at the hypervisor level
B) By infecting BIOS firmware to make decryption impossible
C) By exploiting web browsers to inject ransomware
D) By disabling antivirus software before encrypting files
✅ Answer: A) By targeting virtual machines and encrypting them at the hypervisor level
📝 Explanation: Hypervisor-level ransomware attacks virtual machines by manipulating the hypervisor, making recovery difficult.
120. What is the main goal of “Sparse Encryption” in ransomware attacks?
A) To encrypt only parts of files, making encryption faster and harder to detect
B) To encrypt data stored only on removable devices
C) To avoid encrypting system files and prevent easy detection
D) To delete unimportant files before encryption begins
✅ Answer: A) To encrypt only parts of files, making encryption faster and harder to detect
📝 Explanation: Sparse encryption affects only portions of files, reducing processing time while still rendering them useless.
121. What is “Ransomware Telemetry Analysis”?
A) Tracking ransomware activity across multiple infections
B) Encrypting telemetry data before a ransom demand
C) Sending ransomware-related alerts to law enforcement
D) A technique used to disable antivirus software
✅ Answer: A) Tracking ransomware activity across multiple infections
📝 Explanation: Telemetry analysis helps cybersecurity experts understand how ransomware spreads and evolves.
122. What is “Live-Off-The-Land” (LOTL) ransomware?
A) A ransomware attack that abuses legitimate system tools to avoid detection
B) A ransomware attack that only targets government infrastructure
C) A ransomware attack that spreads through social engineering only
D) A ransomware attack that encrypts data in a virtual sandbox
✅ Answer: A) A ransomware attack that abuses legitimate system tools to avoid detection
📝 Explanation: LOTL ransomware leverages built-in system tools (e.g., PowerShell, WMI) to execute attacks without dropping external malware files.
123. What is a “Hybrid Ransomware Attack”?
A) An attack that combines encryption with data theft (double extortion)
B) A ransomware attack that spreads through mobile and desktop devices
C) A ransomware variant that encrypts only cloud-stored data
D) A ransomware attack that uses two different encryption methods
✅ Answer: A) An attack that combines encryption with data theft (double extortion)
📝 Explanation: Hybrid ransomware attacks encrypt files and steal data, increasing pressure on victims to pay.
124. How does “Detonating Ransomware” differ from regular ransomware?
A) It deletes all data if a ransom isn’t paid within a specific timeframe
B) It infects only air-gapped systems
C) It decrypts files only after multiple payments
D) It spreads through SMS messages
✅ Answer: A) It deletes all data if a ransom isn’t paid within a specific timeframe
📝 Explanation: Detonating ransomware is programmed to permanently delete files if the ransom isn’t paid in time.
125. Why do attackers use “Ransomware Fake-Outs”?
A) To make victims believe files are encrypted when they are not
B) To install spyware instead of encrypting files
C) To delete system logs before executing ransomware
D) To disable antivirus software remotely
✅ Answer: A) To make victims believe files are encrypted when they are not
📝 Explanation: Some ransomware strains display fake encryption messages to scare victims into paying, even though no encryption has occurred.
126. What is “Self-Spreading Ransomware”?
A) Ransomware that replicates itself across a network without user intervention
B) Ransomware that can execute without administrator privileges
C) Ransomware that spreads through Bluetooth only
D) Ransomware that uses physical USB drives for propagation
✅ Answer: A) Ransomware that replicates itself across a network without user intervention
📝 Explanation: Self-spreading ransomware (e.g., WannaCry) uses worm-like behavior to infect multiple systems automatically.
127. What is “Ransomware Code Obfuscation”?
A) Modifying ransomware code to avoid detection by security tools
B) Encrypting the attacker’s own malware to prevent reverse engineering
C) A technique to spread ransomware faster
D) Encrypting only application logs instead of user data
✅ Answer: A) Modifying ransomware code to avoid detection by security tools
📝 Explanation: Code obfuscation makes ransomware harder to analyze, preventing security tools from detecting it.
128. What is the “Initial Payload Delivery Mechanism” in a ransomware attack?
A) The first method used to infect a system with ransomware
B) The decryption key storage system
C) A self-destruct mechanism in ransomware
D) A type of email filtering service
✅ Answer: A) The first method used to infect a system with ransomware
📝 Explanation: Attackers use various initial payload delivery methods (e.g., phishing, drive-by downloads) to deploy ransomware.
129. How do attackers use “Side-Loading” in ransomware deployment?
A) By tricking legitimate applications into loading malicious DLL files
B) By modifying BIOS firmware before encryption
C) By exploiting Bluetooth vulnerabilities in enterprise networks
D) By injecting ransomware into social media apps
✅ Answer: A) By tricking legitimate applications into loading malicious DLL files
📝 Explanation: DLL side-loading exploits trusted applications to execute ransomware without triggering security alerts.
130. What is “Mutating Ransomware”?
A) Ransomware that changes its code and encryption patterns frequently
B) Ransomware that spreads through machine learning algorithms
C) A ransomware variant that deletes files after 24 hours
D) Ransomware that only affects mobile operating systems
✅ Answer: A) Ransomware that changes its code and encryption patterns frequently
📝 Explanation: Mutating ransomware uses polymorphic techniques to avoid detection by security tools.
131. What is the primary method attackers use to evade Endpoint Detection and Response (EDR) systems in ransomware attacks?
A) Using fileless execution techniques
B) Encrypting ransom notes before sending
C) Deleting ransomware payloads after execution
D) Sending ransom demands via social media
✅ Answer: A) Using fileless execution techniques
📝 Explanation: Fileless ransomware operates entirely in system memory, bypassing traditional EDR and antivirus detection.
132. How does “Attack Surface Reduction (ASR)” help prevent ransomware attacks?
A) By minimizing exploitable system vulnerabilities
B) By creating a sandbox for ransomware
C) By forcing ransomware to run in an isolated virtual machine
D) By increasing the complexity of encryption
✅ Answer: A) By minimizing exploitable system vulnerabilities
📝 Explanation: ASR limits the ways ransomware can gain access by disabling unnecessary ports, macros, and remote access services.
133. What is “Behavioral Ransomware Detection”?
A) Identifying ransomware by monitoring file encryption patterns and abnormal activity
B) Detecting ransomware using signature-based analysis
C) Preventing ransomware by using antivirus updates
D) Using honeypots to analyze ransomware behavior
✅ Answer: A) Identifying ransomware by monitoring file encryption patterns and abnormal activity
📝 Explanation: Behavioral detection identifies ransomware by tracking rapid file changes, CPU spikes, and unauthorized encryption.
134. What is “Ransomware Broker-as-a-Service” (RBaaS)?
A) Cybercriminals selling stolen data from ransomware victims
B) A subscription model for attackers to distribute ransomware
C) A security tool for recovering encrypted files
D) A dark web forum for ransomware developers
✅ Answer: B) A subscription model for attackers to distribute ransomware
📝 Explanation: RBaaS enables affiliates to distribute ransomware while paying a commission to developers.
135. What is “Ransomware Chain Attacks”?
A) Using multiple attack vectors to infect victims
B) Spreading ransomware across multiple machines in a sequential manner
C) Encrypting files in a multi-step process
D) Attacking supply chains to distribute ransomware
✅ Answer: D) Attacking supply chains to distribute ransomware
📝 Explanation: Supply chain ransomware attacks infect software vendors, spreading malware to downstream customers.
136. How do ransomware gangs use “Insider Threats” to launch attacks?
A) By bribing or blackmailing employees to deploy ransomware
B) By using infected IoT devices inside corporate networks
C) By placing malicious ads on a company website
D) By disabling company firewalls through social engineering
✅ Answer: A) By bribing or blackmailing employees to deploy ransomware
📝 Explanation: Some ransomware gangs recruit insiders to disable security controls and manually execute ransomware.
137. What is “Ransomware Kill Chain Disruption”?
A) Interrupting the various stages of a ransomware attack before execution
B) Using decryption keys to stop ransomware
C) Delaying ransomware execution until it is detected
D) Tracking ransomware payments to their source
✅ Answer: A) Interrupting the various stages of a ransomware attack before execution
📝 Explanation: Kill chain disruption prevents initial access, lateral movement, or data exfiltration, stopping ransomware before encryption starts.
138. What does “File Entropy Analysis” detect in ransomware protection?
A) An unusually high level of randomness in encrypted files
B) The presence of ransomware executable files
C) The attacker’s IP address
D) Decryption keys stored in the system
✅ Answer: A) An unusually high level of randomness in encrypted files
📝 Explanation: File entropy analysis detects sudden increases in randomness, indicating ransomware encryption activity.
139. How do attackers use “Trusted Platform Module (TPM) Ransomware”?
A) By encrypting the TPM chip to prevent system recovery
B) By using TPM security flaws to execute ransomware
C) By exploiting TPM to gain remote access
D) By locking BIOS settings using ransomware
✅ Answer: A) By encrypting the TPM chip to prevent system recovery
📝 Explanation: TPM ransomware can encrypt system boot processes, making recovery difficult without replacing hardware.
140. What is “Self-Destructing Ransomware”?
A) Ransomware that deletes itself after execution to avoid detection
B) Ransomware that removes itself after decryption
C) Ransomware that deletes encrypted files permanently
D) A type of ransomware that spreads through cloud services
✅ Answer: A) Ransomware that deletes itself after execution to avoid detection
📝 Explanation: Self-destructing ransomware removes traces of infection, making forensic investigation more difficult.
141. Why do some ransomware attacks include “Dual Payloads”?
A) To ensure data theft even if encryption fails
B) To launch ransomware attacks from two locations
C) To encrypt files on separate hard drives
D) To execute a DDoS attack alongside ransomware
✅ Answer: A) To ensure data theft even if encryption fails
📝 Explanation: Dual-payload ransomware both steals data and encrypts files, ensuring double extortion pressure.
142. What is “Dormant Ransomware”?
A) Ransomware that remains inactive for a period before executing
B) Ransomware that only encrypts temporary files
C) Ransomware that targets IoT devices
D) Ransomware that can only be activated manually
✅ Answer: A) Ransomware that remains inactive for a period before executing
📝 Explanation: Dormant ransomware stays hidden for weeks or months, evading immediate detection.
143. How do attackers use “Exploiting Patch Gaps” in ransomware attacks?
A) By targeting systems that haven’t yet applied security patches
B) By encrypting only unpatched files
C) By installing malicious patches
D) By bypassing firewalls through outdated firmware
✅ Answer: A) By targeting systems that haven’t yet applied security patches
📝 Explanation: Attackers exploit unpatched vulnerabilities before organizations apply security fixes.
144. How does “Ransomware Fakeware” work?
A) By pretending to encrypt files without actually doing so
B) By infecting only cloud storage services
C) By targeting mobile devices with fake updates
D) By hiding ransom notes in encrypted files
✅ Answer: A) By pretending to encrypt files without actually doing so
📝 Explanation: Some ransomware threats trick victims into paying even though no encryption occurs.
145. What is “Geo-Targeted Ransomware”?
A) Ransomware that attacks specific regions or countries
B) Ransomware that spreads through GPS tracking
C) Ransomware that only affects government agencies
D) Ransomware that encrypts data based on time zones
✅ Answer: A) Ransomware that attacks specific regions or countries
📝 Explanation: Geo-targeted ransomware avoids infecting certain countries where attackers operate to evade legal issues.
146. What is “Ransomware Replay Attack”?
A) A ransomware attack that reinfects the same system multiple times
B) A ransomware attack that spreads through replayed network traffic
C) A ransomware attack that changes its encryption key periodically
D) A ransomware attack that deletes backups automatically
✅ Answer: A) A ransomware attack that reinfects the same system multiple times
📝 Explanation: Replay attacks occur when ransomware persists, reinfecting systems after initial recovery.
147. What is “Time-Locked Ransomware”?
A) Ransomware that delays execution until a specific date
B) Ransomware that only encrypts files during off-peak hours
C) Ransomware that requires multiple payments over time
D) Ransomware that only affects real-time applications
✅ Answer: A) Ransomware that delays execution until a specific date
📝 Explanation: Time-locked ransomware remains inactive for weeks or months before starting encryption, making detection harder.
148. What is the primary risk of allowing administrative access through Remote Desktop Protocol (RDP)?
A) It enables attackers to brute-force credentials and deploy ransomware
B) It automatically grants administrator rights to any user
C) It prevents ransomware attacks by isolating network connections
D) It encrypts user sessions to block unauthorized access
✅ Answer: A) It enables attackers to brute-force credentials and deploy ransomware
📝 Explanation: RDP brute-force attacks are a common method for gaining unauthorized access and deploying ransomware.
149. What is “Ransomware Code Injection”?
A) Injecting malicious code into legitimate processes to bypass security software
B) Injecting encryption keys into ransom notes
C) Injecting fake error messages to trick victims
D) Injecting ransomware via social media ads
✅ Answer: A) Injecting malicious code into legitimate processes to bypass security software
📝 Explanation: Code injection allows ransomware to hide inside legitimate applications, making detection difficult.
150. How does “Ransomware AI Evasion” work?
A) By modifying behavior to avoid detection by machine learning security systems
B) By using AI-powered encryption
C) By mimicking legitimate software
D) By spreading only through AI-generated phishing emails
✅ Answer: A) By modifying behavior to avoid detection by machine learning security systems
📝 Explanation: Advanced ransomware can modify its execution patterns to avoid triggering AI-based security defenses.
151. What is “Pay-Per-Infection” (PPI) in ransomware campaigns?
A) A model where affiliates get paid for each infected system
B) A system where victims pay for every file they decrypt
C) A program used to track ransom payments
D) A method for attackers to earn cryptocurrency rewards
✅ Answer: A) A model where affiliates get paid for each infected system
📝 Explanation: PPI ransomware programs pay cybercriminals per successful infection, encouraging wider ransomware distribution.
152. What is a “Hybrid Encryption Scheme” in ransomware attacks?
A) Combining symmetric and asymmetric encryption to make decryption harder
B) Using blockchain technology to encrypt data
C) Encrypting both local and cloud files at the same time
D) Using AI-generated encryption keys
✅ Answer: A) Combining symmetric and asymmetric encryption to make decryption harder
📝 Explanation: Hybrid encryption uses symmetric encryption (fast) for files and asymmetric encryption (secure) for decryption keys.
153. Why do ransomware gangs use “Ephemeral Bitcoin Wallets”?
A) To create one-time-use wallets that make ransom payments harder to trace
B) To store long-term ransom profits
C) To prevent victims from recovering their files
D) To automatically convert ransom payments into gift cards
✅ Answer: A) To create one-time-use wallets that make ransom payments harder to trace
📝 Explanation: Ephemeral Bitcoin wallets are temporary and frequently changed, making it difficult to track ransom transactions.
154. How does “Encrypted Command-and-Control (C2) Communication” help ransomware gangs?
A) It hides ransomware activity by encrypting attacker-victim communication
B) It speeds up ransomware execution
C) It makes ransomware immune to antivirus detection
D) It forces victims to pay through encrypted messages
✅ Answer: A) It hides ransomware activity by encrypting attacker-victim communication
📝 Explanation: Encrypted C2 traffic makes it harder for security teams to detect and block ransomware communications.
155. What is “Cloud-Based Ransomware”?
A) Ransomware that targets data stored in cloud services instead of local machines
B) A backup tool used to restore encrypted files
C) A ransomware strain that can only spread through SaaS applications
D) A method for attackers to launch DDoS attacks using cloud networks
✅ Answer: A) Ransomware that targets data stored in cloud services instead of local machines
📝 Explanation: Cloud-based ransomware attacks services like Google Drive, OneDrive, and AWS, encrypting or deleting cloud-stored files.
156. What is the role of “Memory Injection” in ransomware attacks?
A) Running ransomware directly in memory to avoid file-based detection
B) Encrypting RAM instead of files
C) Overloading system memory to crash security software
D) Using memory-based processes to restore encrypted files
✅ Answer: A) Running ransomware directly in memory to avoid file-based detection
📝 Explanation: Memory injection enables ransomware to execute without leaving a trace on the disk, bypassing antivirus software.
157. What is “Red Team Simulation” in ransomware prevention?
A) Ethical hackers testing an organization’s resilience to ransomware attacks
B) A legal process to track ransomware gangs
C) A government program that decrypts ransomware files
D) A system for negotiating lower ransom payments
✅ Answer: A) Ethical hackers testing an organization’s resilience to ransomware attacks
📝 Explanation: Red Team simulations help organizations prepare for ransomware attacks by mimicking real-world attack scenarios.
158. How do ransomware groups use “Credential Harvesting” before launching an attack?
A) By stealing usernames and passwords to gain access to networks
B) By encrypting only credential files
C) By using fake logins to trick cybersecurity analysts
D) By blocking access to authentication services
✅ Answer: A) By stealing usernames and passwords to gain access to networks
📝 Explanation: Credential harvesting provides ransomware attackers legitimate login details, making detection harder.
159. What is “Machine Learning-Based Ransomware Detection”?
A) Using AI to identify ransomware behavior before execution
B) Encrypting AI-generated models to prevent cyber threats
C) Using neural networks to launch ransomware attacks
D) A technique to track ransom payments automatically
✅ Answer: A) Using AI to identify ransomware behavior before execution
📝 Explanation: Machine learning-based security tools analyze patterns in ransomware execution, stopping attacks before encryption.
160. What is “Mimicware” in ransomware attacks?
A) Ransomware that mimics legitimate software to avoid detection
B) Ransomware that only encrypts system logs
C) A ransomware strain that spreads through Bluetooth devices
D) A security tool designed to prevent ransomware attacks
✅ Answer: A) Ransomware that mimics legitimate software to avoid detection
📝 Explanation: Mimicware ransomware disguises itself as legitimate programs or system updates, tricking users into execution.
161. What is “Steganographic Ransomware”?
A) Ransomware that hides malicious code inside images or multimedia files
B) Ransomware that only encrypts database tables
C) A form of ransomware that spreads via text messages
D) Ransomware that automatically deletes encrypted files after 24 hours
✅ Answer: A) Ransomware that hides malicious code inside images or multimedia files
📝 Explanation: Steganographic ransomware uses steganography to embed malicious code within images, audio, or videos, making detection difficult.
162. What is the purpose of a “Ransomware Canary File”?
A) To detect ransomware activity by monitoring unauthorized encryption attempts
B) To block ransomware from spreading in the network
C) To collect ransom payments securely
D) To create a decryption key for ransomware victims
✅ Answer: A) To detect ransomware activity by monitoring unauthorized encryption attempts
📝 Explanation: Canary files are fake documents that trigger an alert if modified, helping detect ransomware attacks early.
163. How does “Distributed Ransomware” increase its impact?
A) By infecting multiple systems simultaneously across different locations
B) By self-replicating only in IoT devices
C) By encrypting system logs instead of user data
D) By demanding multiple payments from the same victim
✅ Answer: A) By infecting multiple systems simultaneously across different locations
📝 Explanation: Distributed ransomware is designed to spread across large networks, including cloud environments and global offices.
164. What is the role of “Data Shadowing” in ransomware attacks?
A) Creating hidden copies of encrypted files to increase data loss pressure
B) Blocking backup systems from recovering files
C) Encrypting only duplicate files on a system
D) Using AI to track victim response times
✅ Answer: A) Creating hidden copies of encrypted files to increase data loss pressure
📝 Explanation: Data shadowing ensures that even if the victim restores files, hidden encrypted copies remain, increasing the ransom leverage.
165. How does “Hypervisor Injection” make ransomware attacks more effective?
A) By allowing ransomware to execute at the hypervisor level, bypassing OS-level security controls
B) By encrypting hypervisor logs to hide attack traces
C) By infecting only virtualized environments
D) By targeting hardware security modules (HSMs)
✅ Answer: A) By allowing ransomware to execute at the hypervisor level, bypassing OS-level security controls
📝 Explanation: Hypervisor injection lets ransomware take over virtual machines, making it extremely difficult to detect and remove.
166. What is “Ransomware Deception Technology”?
A) A security method that uses fake ransomware to trick attackers
B) A cybercriminal tactic to fake encryption without actually locking files
C) A technique where security tools mimic a vulnerable environment to detect attacks
D) A method of securely paying ransom anonymously
✅ Answer: C) A technique where security tools mimic a vulnerable environment to detect attacks
📝 Explanation: Deception technology sets up fake endpoints to lure ransomware and detect malicious behavior early.
167. What is the main function of “Digital Forensics” in ransomware response?
A) To investigate how the attack happened and prevent future incidents
B) To negotiate with ransomware operators
C) To store ransom payment details securely
D) To automate decryption of ransomware-infected files
✅ Answer: A) To investigate how the attack happened and prevent future incidents
📝 Explanation: Digital forensics helps organizations analyze ransomware attacks, find entry points, and improve defenses.
168. What does “Time-Limited Decryption” mean in ransomware attacks?
A) Attackers provide a decryption key that expires after a certain period
B) Decryption keys are only available to victims for 24 hours
C) Ransom payments are only accepted for a short time
D) Files decrypt automatically if the ransom isn’t paid
✅ Answer: A) Attackers provide a decryption key that expires after a certain period
📝 Explanation: Some ransomware decryption keys expire after a deadline, forcing victims to pay quickly or lose access permanently.
169. How do attackers use “Cloud-Mediated Ransomware”?
A) By leveraging cloud synchronization to spread ransomware across devices
B) By targeting cloud-only businesses
C) By infecting only mobile devices connected to the cloud
D) By bypassing cloud-based security tools
✅ Answer: A) By leveraging cloud synchronization to spread ransomware across devices
📝 Explanation: Cloud-mediated ransomware infects cloud storage services, ensuring encryption spreads across multiple linked devices.
170. What is “Identity-Based Ransomware”?
A) Ransomware that targets specific individuals based on their online data
B) Ransomware that only encrypts identity-related files
C) A ransomware type that locks accounts instead of encrypting files
D) A ransomware attack that spreads through identity theft services
✅ Answer: A) Ransomware that targets specific individuals based on their online data
📝 Explanation: Identity-based ransomware uses publicly available information to personalize ransom demands for high-value individuals.
171. Why do some ransomware attacks use “Diversionary Tactics”?
A) To distract security teams while executing the real attack
B) To redirect ransom payments to another cryptocurrency wallet
C) To make the ransomware execute multiple times
D) To encrypt random files instead of important data
✅ Answer: A) To distract security teams while executing the real attack
📝 Explanation: Diversionary tactics include fake DDoS attacks, phishing waves, or malware distractions to delay incident response.
172. What is “Quantum-Safe Ransomware”?
A) Ransomware that can resist future quantum computing-based decryption
B) Ransomware that only targets quantum computing systems
C) A technique for using quantum cryptography to prevent ransomware
D) A method for tracking ransom payments using quantum algorithms
✅ Answer: A) Ransomware that can resist future quantum computing-based decryption
📝 Explanation: Quantum-safe ransomware is designed to use encryption resistant to quantum computing-based attacks, making decryption harder in the future.
173. What is the primary role of a “Security Orchestration, Automation, and Response (SOAR)” system in ransomware defense?
A) To automate detection, containment, and response to ransomware incidents
B) To block all network activity during a ransomware attack
C) To create backups automatically before a ransomware attack occurs
D) To track ransom payments in real-time
✅ Answer: A) To automate detection, containment, and response to ransomware incidents
📝 Explanation: SOAR systems use AI-driven automation to detect, analyze, and respond to ransomware threats in real time.
174. What is “Coercionware” in ransomware threats?
A) A variant where attackers threaten physical harm if ransom isn’t paid
B) Ransomware that forces victims to spread the infection to others
C) Ransomware that offers a discount for early payment
D) Ransomware that hides in legitimate software updates
✅ Answer: A) A variant where attackers threaten physical harm if ransom isn’t paid
📝 Explanation: Coercionware takes extortion beyond data encryption, threatening personal harm or legal trouble.
175. What is “Intermittent Encryption” in ransomware attacks?
A) Encrypting only parts of a file to evade detection and speed up encryption
B) Encrypting files at random intervals to confuse victims
C) Encrypting only certain file types based on user activity
D) Encrypting files in reverse order to avoid detection
✅ Answer: A) Encrypting only parts of a file to evade detection and speed up encryption
📝 Explanation: Intermittent encryption makes ransomware harder to detect because it encrypts only segments of files, reducing processing time.
176. What is the purpose of “Active Directory Exploitation” in ransomware attacks?
A) To gain control over an organization’s authentication and privilege systems
B) To encrypt user passwords only
C) To spread ransomware using mobile devices
D) To disable all security tools remotely
✅ Answer: A) To gain control over an organization’s authentication and privilege systems
📝 Explanation: Attackers compromise Active Directory (AD) to escalate privileges, move laterally across the network, and deploy ransomware at scale.
177. What is “Malware as a Distraction” in ransomware operations?
A) Using other types of malware (trojans, worms) to divert attention from the ransomware attack
B) Deploying ransomware in stages to confuse security teams
C) Hiding ransomware within legal software installations
D) Using ransomware to trick security teams into deleting critical files
✅ Answer: A) Using other types of malware (trojans, worms) to divert attention from the ransomware attack
📝 Explanation: Attackers deploy secondary malware (e.g., trojans, keyloggers) to distract security teams while executing the real ransomware payload.
178. What is “Credential Dumping” and how does it assist ransomware attacks?
A) Extracting stored usernames and passwords to gain access to networks
B) Deleting user credentials before encryption
C) Encrypting only password-protected files
D) Injecting ransomware into credential management software
✅ Answer: A) Extracting stored usernames and passwords to gain access to networks
📝 Explanation: Credential dumping allows ransomware operators to extract credentials from systems like LSASS, Mimikatz, or SAM files to expand their access.
179. What is “Multi-Extortion Ransomware”?
A) A ransomware attack that uses multiple extortion methods such as encryption, data theft, and harassment
B) A ransomware attack that spreads to multiple devices simultaneously
C) A ransomware strain that requires multiple payments over time
D) A technique that encrypts only database files
✅ Answer: A) A ransomware attack that uses multiple extortion methods such as encryption, data theft, and harassment
📝 Explanation: Multi-extortion ransomware combines encryption, public data leaks, and even harassment (emails/calls to executives) to force payment.
180. How do ransomware groups use “Voice Phishing” (Vishing)?
A) By calling victims and impersonating IT support to gain access
B) By using AI-generated voices to trick users
C) By leaving encrypted voicemail messages
D) By targeting mobile networks with automated ransom calls
✅ Answer: A) By calling victims and impersonating IT support to gain access
📝 Explanation: Vishing (Voice Phishing) is used to trick victims into providing login credentials or executing malware, helping attackers gain access.
181. What is “Fileless Ransomware Execution”?
A) Running ransomware entirely in memory without writing files to disk
B) Encrypting only files stored in RAM
C) Using fake error messages to execute ransomware
D) Bypassing firewalls using encrypted ransomware payloads
✅ Answer: A) Running ransomware entirely in memory without writing files to disk
📝 Explanation: Fileless ransomware operates entirely in RAM, making it harder for traditional antivirus solutions to detect it.
182. How does “Lateral Movement” increase the impact of ransomware?
A) By spreading ransomware across an organization’s internal network before encrypting files
B) By encrypting files from external storage devices
C) By modifying security settings before execution
D) By creating duplicate encrypted copies of files
✅ Answer: A) By spreading ransomware across an organization’s internal network before encrypting files
📝 Explanation: Lateral movement enables ransomware to infect multiple endpoints, ensuring a larger attack surface before encryption starts.
183. What is “Double-Key Ransomware Encryption”?
A) Using two different encryption keys to make decryption even harder
B) Encrypting files twice to increase ransom demands
C) Encrypting both the cloud and local versions of files
D) Encrypting user accounts instead of files
✅ Answer: A) Using two different encryption keys to make decryption even harder
📝 Explanation: Double-key encryption involves encrypting files with two separate keys, preventing decryption even if one key is recovered.
184. What is “API Hooking” in ransomware attacks?
A) Manipulating system APIs to disable security functions and execute malware
B) Using software APIs to spread ransomware across applications
C) Encrypting APIs to disrupt cloud services
D) Hooking into antivirus APIs to make ransomware execute faster
✅ Answer: A) Manipulating system APIs to disable security functions and execute malware
📝 Explanation: API Hooking allows ransomware to intercept and modify system functions, such as disabling security tools before execution.
185. What is “Hybrid Cloud Ransomware”?
A) Ransomware that targets both on-premise and cloud environments simultaneously
B) Ransomware that spreads through hybrid networks
C) Ransomware that attacks only multi-cloud deployments
D) Ransomware that encrypts files based on cloud storage location
✅ Answer: A) Ransomware that targets both on-premise and cloud environments simultaneously
📝 Explanation: Hybrid cloud ransomware attacks corporate networks and cloud services together, maximizing damage.
186. How does “Fast-Flux Botnets” support ransomware campaigns?
A) By rapidly changing C2 server IP addresses to avoid detection
B) By distributing ransomware payloads across different networks
C) By infecting victims using fast-spreading phishing attacks
D) By increasing encryption speed for maximum damage
✅ Answer: A) By rapidly changing C2 server IP addresses to avoid detection
📝 Explanation: Fast-flux botnets rotate command-and-control (C2) servers, making it harder to track or block ransomware communications.
187. What is “Ransomware File Marker”?
A) A unique identifier added to encrypted files to track infections
B) A hidden tracker in ransomware code for attribution
C) A watermark added to decrypted files
D) A method for renaming files after decryption
✅ Answer: A) A unique identifier added to encrypted files to track infections
📝 Explanation: File markers help ransomware operators identify which files are encrypted and track ransom payment statuses.
188. What is “Ransomware Kill-Switch Implantation”?
A) A hidden backdoor that allows attackers to remotely disable the ransomware
B) A mechanism that prevents antivirus from stopping ransomware
C) A kill-switch built into ransom payment methods
D) A technique for deleting decryption keys remotely
✅ Answer: A) A hidden backdoor that allows attackers to remotely disable the ransomware
📝 Explanation: Some ransomware has built-in kill-switches, allowing attackers to remotely disable encryption if ransom negotiations fail.
189. What is “Multi-Payload Ransomware”?
A) Ransomware that delivers additional malware like keyloggers or spyware alongside encryption
B) Ransomware that spreads across different OS platforms
C) A ransomware strain that encrypts files in multiple rounds
D) A ransomware variant that deletes files instead of encrypting them
✅ Answer: A) Ransomware that delivers additional malware like keyloggers or spyware alongside encryption
📝 Explanation: Multi-payload ransomware infects victims with additional malware (such as trojans, keyloggers, or spyware) for extended attacks.
191. What is “Ransomware Decoy Encryption”?
A) Encrypting fake files to mislead forensic investigators while encrypting real data in the background
B) Encrypting only system logs instead of actual files
C) Using a secondary ransomware payload after the first attack
D) Encrypting only cloud backups to increase ransom demand
✅ Answer: A) Encrypting fake files to mislead forensic investigators while encrypting real data in the background
📝 Explanation: Decoy encryption is used to trick investigators into thinking they have found the malware, while the real encryption process continues undetected.
192. What is “Server-Side Ransomware”?
A) Ransomware that specifically targets servers and backend infrastructure instead of individual computers
B) Ransomware that infects only cloud storage services
C) A ransomware attack that affects only database servers
D) A ransomware variant that self-replicates across networks
✅ Answer: A) Ransomware that specifically targets servers and backend infrastructure instead of individual computers
📝 Explanation: Server-side ransomware is designed to compromise critical enterprise infrastructure, such as file servers, databases, and cloud systems, to maximize disruption.
193. What is “Deepfake-Assisted Ransomware Attacks”?
A) Using AI-generated deepfake voices or videos to trick employees into installing ransomware
B) Using ransomware to manipulate deepfake technology
C) A ransomware attack that modifies personal photos using deepfake software
D) A technique where ransomware disguises itself as deepfake software
✅ Answer: A) Using AI-generated deepfake voices or videos to trick employees into installing ransomware
📝 Explanation: Deepfake-assisted ransomware leverages AI-generated fake voices or videos to impersonate executives or IT staff, tricking employees into running malicious software.
194. What is “Ransomware Dropper Chain”?
A) A multi-step infection process where an initial malware dropper installs ransomware later
B) A ransom demand that increases in stages
C) A ransomware strain that uses three different encryption methods
D) A backup mechanism for storing ransom notes
✅ Answer: A) A multi-step infection process where an initial malware dropper installs ransomware later
📝 Explanation: Dropper chains allow ransomware to stay hidden for long periods before being activated by secondary malware components.
195. How does “Geo-Fencing Ransomware” operate?
A) It limits ransomware infections to specific geographical regions
B) It encrypts files based on time zone differences
C) It prevents ransom payments from being traced across countries
D) It spreads ransomware only through GPS-enabled devices
✅ Answer: A) It limits ransomware infections to specific geographical regions
📝 Explanation: Geo-fencing ransomware is programmed to avoid attacking certain countries (e.g., those where the ransomware gang operates) and target specific regions.
196. What is “Network Kill-Switch Ransomware”?
A) Ransomware that disables network communications to prevent response teams from mitigating the attack
B) Ransomware that spreads only through Wi-Fi networks
C) A ransomware strain that deletes network configurations after encryption
D) A ransomware type that blocks firewall security settings
✅ Answer: A) Ransomware that disables network communications to prevent response teams from mitigating the attack
📝 Explanation: Some advanced ransomware strains include a network kill-switch that disconnects affected devices from networks, preventing mitigation efforts.
197. What is the goal of “Data Poisoning Ransomware”?
A) To corrupt or alter victim data instead of encrypting it, making recovery impossible
B) To encrypt only sensitive government files
C) To prevent victims from detecting the ransomware for an extended period
D) To delete security software before execution
✅ Answer: A) To corrupt or alter victim data instead of encrypting it, making recovery impossible
📝 Explanation: Data poisoning ransomware doesn’t just encrypt files—it modifies or destroys data, making forensic recovery nearly impossible.
198. What is “Cloud Persistence Ransomware”?
A) Ransomware that installs itself within cloud services to survive reboots and recovery attempts
B) A ransomware strain that only targets Google Drive and OneDrive
C) Ransomware that spreads only via SaaS applications
D) A ransomware type that infects only enterprise email services
✅ Answer: A) Ransomware that installs itself within cloud services to survive reboots and recovery attempts
📝 Explanation: Cloud persistence ransomware embeds itself in cloud storage or SaaS applications, ensuring it remains active even after system restoration.
199. How does “Quantum Computing-Resistant Ransomware” increase security risks?
A) By using encryption methods that cannot be broken by quantum computers
B) By preventing ransomware from being detected by AI-based security tools
C) By modifying blockchain transactions to hide ransom payments
D) By encrypting only high-speed computing servers
✅ Answer: A) By using encryption methods that cannot be broken by quantum computers
📝 Explanation: Some ransomware gangs use quantum-resistant encryption, ensuring that even future quantum decryption methods won’t work.
200. What is “Automated Ransomware Negotiation Chatbots”?
A) AI-powered chatbots that communicate with victims to speed up ransom payments
B) Chatbots designed to help victims recover encrypted files
C) A cybersecurity tool used to detect ransomware
D) A service for tracking ransom payments across the dark web
✅ Answer: A) AI-powered chatbots that communicate with victims to speed up ransom payments
📝 Explanation: Some ransomware gangs use automated chatbots to negotiate ransoms, offer payment extensions, or apply pressure on victims, making the extortion process more efficient.
201. What is “Blockchain-Based Ransomware”?
A) Ransomware that leverages blockchain technology for encryption and ransom tracking
B) A ransomware strain that infects only cryptocurrency wallets
C) A blockchain-based security tool designed to prevent ransomware attacks
D) A type of ransomware that spreads via smart contracts
✅ Answer: A) Ransomware that leverages blockchain technology for encryption and ransom tracking
📝 Explanation: Blockchain-based ransomware uses decentralized ledgers for ransom payments and tracking, making transactions harder to trace and disrupt.
202. How does “Remote Wipe Ransomware” increase the threat level for organizations?
A) It gives attackers the ability to delete all data if the ransom is not paid
B) It wipes out backup systems before executing encryption
C) It targets mobile devices with factory reset commands
D) It encrypts files without leaving any trace
✅ Answer: A) It gives attackers the ability to delete all data if the ransom is not paid
📝 Explanation: Remote wipe ransomware introduces a higher level of extortion by threatening to permanently erase all files if payment is delayed.
203. What is “AI-Powered Ransomware”?
A) Ransomware that uses artificial intelligence to adapt its attack strategy and avoid detection
B) A ransomware strain that encrypts only AI-generated files
C) A machine-learning algorithm used to predict ransomware attacks
D) A ransomware type that only targets AI-based applications
✅ Answer: A) Ransomware that uses artificial intelligence to adapt its attack strategy and avoid detection
📝 Explanation: AI-powered ransomware leverages machine learning to analyze security defenses and adjust encryption methods in real time, making it harder to detect and stop.
204. What is the primary function of “Self-Healing Ransomware”?
A) Ransomware that can reinstall itself after being removed by security tools
B) Ransomware that automatically decrypts files after a set period
C) A ransomware strain that mimics antivirus software
D) A ransomware variant that targets only medical institutions
✅ Answer: A) Ransomware that can reinstall itself after being removed by security tools
📝 Explanation: Self-healing ransomware uses hidden backup processes to restore itself even after partial removal, ensuring persistent infection.
205. How does “Cross-Platform Ransomware” expand attack surfaces for cybercriminals?
A) By infecting multiple operating systems (Windows, Linux, macOS) within a single attack campaign
B) By targeting IoT devices and cloud systems simultaneously
C) By encrypting files across both personal and enterprise networks
D) By creating new variants that modify themselves for different hardware architectures
✅ Answer: A) By infecting multiple operating systems (Windows, Linux, macOS) within a single attack campaign
📝 Explanation: Cross-platform ransomware is designed to run on multiple OS platforms, allowing attackers to spread infections across diverse enterprise environments.