The correct answer is 'Exploits a vulnerability to replicate itself and spread to other systems without user intervention'. This is because worms are designed to autonomously spread to other systems, typically without needing any user interaction. They often exploit vulnerabilities in software or protocols to propagate. The incorrect options are not characteristic of worms. 'Resides in the system memory to intercept data' is more indicative of a keylogger. 'Requires a host file to spread to other systems' typically refers to a virus, which is distinct from a worm as it requires user interaction to spread. 'Encrypts files and demands a ransom for decryption' describes ransomware, which is another specific type of malware.