CheckPoint 156-536 Exam - Topic 2 Question 26 Discussion

Ransomware is a form of malicious software (malware) where an attacker encrypts the victim's data, rendering it inaccessible. The attacker then demands a ransom payment from the victim to provide the decryption key that will restore access to the data.

Exact Extract from Official Document:

'Before a Ransomware attack can encrypt files, Anti-Ransomware backs up your files to a safe location. After the attack is stopped, it deletes files involved in the attack and restores the original files from the backup location.' This indicates that ransomware encrypts files, confirming that the attacker encrypts the files and demands a payment for a decryption key.

Check Point Harmony Endpoint Specialist R81.20 Administration Guide, Section: 'Anti-Ransomware'.