nerdexam
(ISC)2

SSCP · Question #1148

What is the main difference between a logic bomb and a stealth virus? (Choose all that apply)

The correct answer is A. Stealth viruses supply AV engines with false information to avoid detection B. Stealth viruses live in memory while logic bombs are written to disk. Stealth viruses actively evade detection by antivirus software and often reside in memory, whereas logic bombs are dormant code triggered by specific conditions and are typically stored on disk.

Submitted by andreas_gr· Apr 18, 2026Security Concepts and Practices

Question

What is the main difference between a logic bomb and a stealth virus? (Choose all that apply)

Options

  • AStealth viruses supply AV engines with false information to avoid detection
  • BStealth viruses live in memory while logic bombs are written to disk
  • CStealth viruses "wake up" at a pre-specified time in the code, then execute payload
  • DLogic Bombs supply AV engines with false information to avoid detection

How the community answered

(45 responses)
  • A
    93% (42)
  • C
    2% (1)
  • D
    4% (2)

Why each option

Stealth viruses actively evade detection by antivirus software and often reside in memory, whereas logic bombs are dormant code triggered by specific conditions and are typically stored on disk.

AStealth viruses supply AV engines with false information to avoid detectionCorrect

Stealth viruses employ techniques to actively hide their presence from antivirus software, often by intercepting AV requests and returning false, clean information about infected files or sectors.

BStealth viruses live in memory while logic bombs are written to diskCorrect

Stealth viruses are designed to reside in memory to avoid detection on disk, while logic bombs are malicious code segments embedded within legitimate programs or scripts that lie dormant on disk until their trigger condition is met.

CStealth viruses "wake up" at a pre-specified time in the code, then execute payload

This describes the behavior of a logic bomb, which executes its payload when a specific condition (like a date, time, or event) is met, not a stealth virus.

DLogic Bombs supply AV engines with false information to avoid detection

Logic bombs are defined by their triggered execution, not by active evasion techniques against antivirus software by supplying false information.

Concept tested: Malware types and evasion techniques

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/intelligence/malware-categories

Topics

#Malware#Viruses#Logic Bombs#Evasion Techniques

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SSCP Practice