Examkin

Soru

Zorluk: KolayMalware Types and Indicators of Compromise

An enterprise system Administrator discovers that a malicious script unexpectedly executed on a server immediately after a terminated employee's user account was disabled. The script was configured to monitor user directory changes and wipe database backups once the account status changed. Which type of malware or malicious code relies on a predefined trigger condition or specific event to execute its payload?

  1. A
    Trojan
  2. Logic bombCevap
  3. C
    Worm
  4. D
    Firewall access control list

Cevap

Logic bomb
A logic bomb is a piece of code intentionally inserted into software that lies dormant until specific logical conditions are met, such as a set date, specific command, or account deletion event.

Adım Adım Çözüm

1
Analyze the incident scenario and key operational indicators.
Identified that the code executed automatically in response to a specific logical event (user account disabling).
Determining the operational trigger distinguishes event-driven malicious code from user-executed or self-propagating threats.
2
Map the execution behavior to established malware classifications.
Malicious code dormant until triggered by specific system state changes or time events matches the definition of a logic bomb.
Logic bombs lie dormant until specific environmental or conditional triggers occur.

Anahtar Kavram

Logic Bomb Indicators and Characteristics
Bu soruyu puanla

Konular

Malware Types and Indicators of Compromise

Bu konudan daha fazla soru