Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

Three weeks after a system administrator resigns from an organization, a database server executing a scheduled midnight payroll job unexpectedly wipes all stored tables. Forensic review of the application's source code identifies an unauthorized script configured to monitor Active Directory for the former administrator's account status. Upon detecting that the account was flagged as disabled, the script automatically triggered the destructive payload. Which of the following malware types best describes this malicious code?

  1. Logic bombAnswer
  2. B
    Ransomware
  3. C
    Worm
  4. D
    Trojan

Answer

Logic bomb
The described malicious script functions as a logic bomb because it remained dormant within the application code until a specific logical trigger occurred—specifically, detecting that the former employee's Active Directory account had been marked as disabled.

Step-by-Step Solution

1
Analyze the incident trigger and execution behavior described in the scenario.
The malicious payload executed only after a predefined system condition occurred (Active Directory account status changing to disabled).
Determining whether code execution is event-triggered, user-initiated, or self-propagating isolates the specific malware classification.
2
Map the execution behavior to official malware definitions.
Dormant code that executes a destructive payload upon meeting specified logical criteria is defined as a logic bomb.
Logic bombs lie undetected until conditional triggers—such as system dates, user logins, or account modifications—evaluate to true.

Key Concept

Logic Bomb Characteristics and Execution Triggers
Estimated Time:1m 0s
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic