A student installs a free photo editor from an unfamiliar forum. It edits photos as promised, but it secretly opens a connection that lets an attacker browse the laptop's files. What type of malware was installed?

After opening a message attachment, a user finds that documents on the computer will not open and a screen demands payment for a decryption key. What type of malware is this?

A laptop seems normal, but a hidden program records everything the user types, including passwords, and sends the records to an attacker every night. Which type of malware is running?

A browser begins showing frequent pop-up ads and redirects searches to shopping sites, even when the user is not visiting those sites. What type of malware most likely caused this?

A student opens an infected game file from a USB drive. Each time the game runs, the malicious code copies itself into other executable files on that computer. What type of malware is this?

Overnight, identical malicious programs appear on hundreds of school computers that were left connected to the network, even though no one opened a file. What type of malware best fits this event?

A downloadable “battery saver” works at first, but it silently installs a remote-control program for an attacker. Which malware type best describes the battery saver download?

An office worker can still start the computer, but every shared project file has been scrambled into unreadable data and a payment note appears. Which malware type caused the main harm?

A student downloads a document template, opens it, and later learns that the same malicious code was inserted into other documents on the laptop. What type of malware is most likely involved?

A free flashlight app fills a phone with full-screen advertisements and pushes ads into unrelated apps. Which malware type best matches the symptom?

A hidden program watches which websites a user visits, collects account names entered in browsers, and sends the information to another computer. What type of malware is this?

A malicious program finds a weakness in one computer's network service, copies itself to another vulnerable computer, and repeats the process automatically. What type of malware is it?

A network administrator finds the same malicious program on 60 computers Monday morning. The computers were left on and connected over the weekend, and no users were present. How did the program most likely spread?

Malware arrived in a spreadsheet sent by email. It ran only after recipients opened the spreadsheet, then attached its code to other files on their computers. Which infection route is described?

A website offers a “free premium version” of a well-known game. The downloaded program launches the game but also installs malware in the background. How did the malware get in?

A student added a free coupon finder to the browser. Soon after, the student's searches and pages visited were being sent to an advertising company. Which route best explains how the spyware entered?

Ransomware encrypted files on an employee's computer and nearby shared folders. It started from a file named “Updated payroll schedule” that arrived by email that morning. Which route allowed the ransomware to begin?

Right after a student installs a free music player, the browser's home page changes and ads start appearing everywhere. How did the adware most likely get onto the computer?

An infected USB drive is used on several computers. On each computer, an employee opens one infected executable, and the code infects more executable files. How did the malware spread?

A worm copies itself from one computer to another through a weakness in a network service, then keeps searching for more targets. What does it need in order to infect the next computer?

A district's file server was hit by ransomware overnight. Staff did not pay, yet by noon every document was usable again. Which measure most likely made this possible?

A worm already reached one computer in each school department, but it could not quickly reach every other department because connections between departmental networks were restricted. Which measure limited the worm's spread?

A keylogger was discovered on a student's laptop after the student had used several accounts. The laptop was cleaned, and the student changed passwords from a different trusted device. Why was changing the passwords important?

A trojan installed a remote-access tool on a lab computer. The technician disconnected the computer from the network before removing the malicious program. What damage did disconnecting it most directly limit?

Ransomware encrypted a shared drive and the backup disk that stayed plugged into the server. A second backup disk, unplugged and kept on a shelf, was undamaged. Why did the second backup survive?

After a virus was found in a shared folder, an administrator removed the infected files and scanned the remaining files before allowing staff to use the folder again. What did the scan help prevent?

A school discovered adware on several computers. The technician removed the unwanted browser extensions and reset the browsers' settings. What symptom did this most directly address?

A worm was detected on one computer. The administrator quickly isolated that computer from the network while other computers were checked. Why did isolation help?

Two infections reached many computers. In the first, employees had to open infected files before the code moved on. In the second, the code spread overnight through network connections with no one using a computer. Which pair identifies them in order?

Two programs both arrived after users installed downloads. The first pretended to be a useful converter app, and the second mainly flooded the browser with ads. Which pair identifies them in order?

Two hidden programs collect information. One records every key typed, and the other records websites visited and sends browsing details away. Which pair identifies them in order?

Two infections caused problems on a network. One copied itself across computers without disguising itself as useful software. The other was delivered inside a program that worked as advertised. Which pair identifies them in order?

Two computers were attacked by criminals. On the first, files are unreadable and a note demands payment. On the second, the criminal can remotely browse files because a fake utility installed a hidden access program. Which pair identifies them in order?

Two malicious programs can both be unnoticed at first. One attaches to an existing file and activates when that file runs. The other records account credentials as a person types. Which pair identifies them in order?

Two infections slow down an office. One creates many copies of itself over the network, and the other shows many ads and uses browser resources. Which pair identifies them in order?

Ransomware starts running on a student's laptop. What does it most directly take from the user?

A keylogger silently sends a daily list of everything typed on a laptop. What is the most direct risk to the user?

An adware program arrives bundled with a free homework app. What does this kind of payload most directly do to the user?

A worm reaches one office computer and keeps copying itself to every computer it can find. What effect does this most directly have?

A fake system-cleanup tool secretly installs a backdoor while appearing to remove junk files. Once it is running, what can its attacker most directly gain?