Which Attack Vector Caused the Resume-Based Ransomware Infection?

Why the Answer Is Correct

The ransom note follows exactly one user action that introduced untrusted outside content: opening a resume received in a message. Spear-phishing is a targeted social-engineering attack in which the attacker crafts a plausible lure — here a job applicant's resume — and delivers malware as an attachment or link; execution of that attachment is the textbook ransomware initial-access path (MITRE ATT&CK T1566.001). The other two actions in the stem, browsing the company's own website and installing OS updates, are routine trusted operations that do not normally deliver an attacker payload. Because the question asks for the most likely vector, the unsolicited-but-opened resume outweighs any speculative compromise of the corporate site. Answer A therefore matches both vendor threat-vector doctrine and the exam's intent.

Why the Other Options Are Wrong

B (watering hole) requires the attacker to first compromise a site the target is known to frequent and plant an exploit there; nothing in the stem says the company website was compromised or served a drive-by payload, and the user only browsed it as a normal employee would. C (infected website) is a vaguer restatement of the same idea and is even weaker, because merely visiting a legitimate corporate site is not evidence of infection — the stem deliberately separates that benign action from the attack to test the distinction. D (typosquatting) depends on the user mistyping a domain and landing on a look-alike site, which is never described. Only option A accounts for a malicious payload arriving through a channel the user actually opened.

Community Comment Notes

saba263 and Fourgehan both selected A, reasoning that the resume opened "from a message" is the targeted lure and that the attachment likely executed the ransomware on open. fd4ea1a chose B but conceded "there is a case for both," arguing the victim visited the company website — a useful reminder that exam stems deliberately include benign look-alike distractors that must be discounted. s_plus's definition of spear-phishing as a targeted, researched social-engineering attack reinforces why the personalized resume is the discriminator rather than a randomly malicious site.