100-160 · Question #2
How do threat actors launch ransomware attacks on organizations?
The correct answer is C. They lock data and deny access to the data until they receive money. Ransomware is a type of malware that denies access to data by encrypting it and demands payment from the victim to restore access. Threat actors may deliver ransomware through phishing emails, malicious downloads, or exploiting vulnerabilities in exposed systems.
Question
How do threat actors launch ransomware attacks on organizations?
Options
- AThey implant malware to collect data from the corporation's financial system.
- BThey deface an organization's public-facing website.
- CThey lock data and deny access to the data until they receive money.
- DThey secretly spy on employees and collect employees' personal information.
How the community answered
(33 responses)- A3% (1)
- C88% (29)
- D9% (3)
Explanation
Ransomware is a type of malware that denies access to data by encrypting it and demands payment from the victim to restore access. Threat actors may deliver ransomware through phishing emails, malicious downloads, or exploiting vulnerabilities in exposed systems.
Topics
Community Discussion
7
Carlos M.Apr 10, 2026C is the right answer. Ransomware works by encrypting your files or locking you out of systems entirely, then demanding payment before they hand over the decryption key, which is exactly what separates it from spyware, defacement, or financial data theft.
Wesley A.May 2, 2026C is the right call and the definition is about as clean as it gets on this exam. Ransomware is specifically about encrypting or locking data and demanding payment for the decryption key, that is the whole attack chain in one sentence. A trips people up because yes, some ransomware variants do exfiltrate financial data before locking it down, but the question asks HOW the attack is launched, meaning the defining mechanism, and that mechanism is denial of access until money changes hands. B is defacement, D is spyware or a stalkerware scenario, neither one has anything to do with ransom.
Sam P.May 4, 2026C is the right call. Ransomware encrypts the victim's files or entire drives and holds the decryption key hostage until a ransom is paid, which is exactly what separates it from spyware (D) or defacement (B), both of which leave the data accessible.
Dimitris E.Apr 2, 2026C is dead right. Ransomware does exactly what the name says, it encrypts your files or locks you out of your systems entirely and the attackers drop a ransom note, usually a .txt or .html file on the desktop, demanding payment in crypto before they hand over the decryption key.
Carlos M.Apr 4, 2026Mostly right, but modern ransomware often exfiltrates data first and threatens to publish it if you don't pay, so even restoring from backups doesn't get you fully out of the jam.
Ola B.Apr 15, 2026Okay so I spun up a quick lab last week simulating a threat actor workflow and honestly everything I saw pointed me toward B on this one. Think about it from the attacker's motive, they want to make a statement and cause maximum visible disruption to the organization, and defacing the public site is the loudest move they can make. Ransomware as a concept is really about leverage and attention, and nothing grabs a board's attention faster than customers seeing a hacked homepage. If you set up even a basic Apache instance in a sandbox and walk through how these campaigns unfold, the public-facing hit is always the dramatic centerpiece that forces the organization to respond.
Wesley A.Apr 18, 2026Ola, I see where you're going with that but the exam is actually looking for C here, because ransomware is primarily financially motivated through extortion, not reputational disruption, and defacement is a separate tactic associated with hacktivism rather than ransomware campaigns specifically.