County clerk workstations suddenly show ransom notes on the desktop and many files have unfamiliar encrypted extensions. Which malware indicator best matches this activity?

Ransomware on county clerk workstations is identified by the pairing of mass file encryption with an extortion demand. Encrypted extensions, unreadability of previously normal documents, and a desktop or dropped note that demands payment are classic indicators that availability and confidentiality of local data have been deliberately weaponized for ransom. In municipal finance and records offices that pattern matters because recovery depends on verified offline backups, isolation of infected hosts, and refusal to treat payment as the primary recovery plan.

A worm that only floods a VLAN with ICMP echo requests is a network-propagation or disruption concept, not file encryption plus extortion; ICMP noise does not turn document libraries into ciphertext or leave a payment note. A logic bomb that waits for a contractor’s last day is a delayed conditional payload; it may delete or sabotage later, but the scenario’s sudden encryption-and-note presentation is not that timer-based pattern. RFID cloning of garage badges is a physical access-credential theft technique at a reader; it explains unauthorized door entry, not desktop ransom notes on clerk PCs.

Exam caveat: SY0-701 expects you to map observable indicators to malware classes. Encryption plus ransom messaging points to ransomware even when other malware families might coexist on the same host. Do not treat “malware” as interchangeable labels—match the dominant indicator set.

Operational check: isolate affected clerk endpoints from shared drives, preserve ransom notes and sample encrypted files for analysis, verify backup integrity offline, reset credentials used on those machines, and hunt for initial access paths such as phishing or exposed remote services before restoring production documents.