Examkin

Question

Difficulty: EasyMalware Types and Indicators of Compromise

An enterprise system Administrator discovers that a malicious script unexpectedly executed on a server immediately after a terminated employee's user account was disabled. The script was configured to monitor user directory changes and wipe database backups once the account status changed. Which type of malware or malicious code relies on a predefined trigger condition or specific event to execute its payload?

  1. A
    Trojan
  2. Logic bombAnswer
  3. C
    Worm
  4. D
    Firewall access control list

Answer

Logic bomb
A logic bomb is a piece of code intentionally inserted into software that lies dormant until specific logical conditions are met, such as a set date, specific command, or account deletion event.

Step-by-Step Solution

1
Analyze the incident scenario and key operational indicators.
Identified that the code executed automatically in response to a specific logical event (user account disabling).
Determining the operational trigger distinguishes event-driven malicious code from user-executed or self-propagating threats.
2
Map the execution behavior to established malware classifications.
Malicious code dormant until triggered by specific system state changes or time events matches the definition of a logic bomb.
Logic bombs lie dormant until specific environmental or conditional triggers occur.

Key Concept

Logic Bomb Indicators and Characteristics
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic