nerdexam
CompTIA

SY0-501 · Question #522

A security administrator is reviewing the following PowerShell script referenced in the Task Scheduler on a database server: $members = GetADGroupMemeber -Identity "Domain Admins" -Recursive |…

The correct answer is C. Logic bomb. The PowerShell script represents a logic bomb because it contains malicious code that is programmed to execute a destructive action only when a specific condition (JohnDoe not being a Domain Admin) is met, leveraging the Task Scheduler for conditional execution.

Submitted by emma.c· Mar 4, 2026Threats, vulnerabilities, and mitigations

Question

A security administrator is reviewing the following PowerShell script referenced in the Task Scheduler on a database server:

$members = GetADGroupMemeber -Identity "Domain Admins" -Recursive | Select - ExpandProperty name if ($members -notcontains "JohnDoe"){ Remove-Item -path C:\Database -recurse -force } Which of the following did the security administrator discover?

Options

  • ARansomeware
  • BBackdoor
  • CLogic bomb
  • DTrojan

How the community answered

(23 responses)
  • A
    13% (3)
  • B
    4% (1)
  • C
    78% (18)
  • D
    4% (1)

Why each option

The PowerShell script represents a logic bomb because it contains malicious code that is programmed to execute a destructive action only when a specific condition (JohnDoe not being a Domain Admin) is met, leveraging the Task Scheduler for conditional execution.

ARansomeware

Ransomware typically encrypts data and demands a ransom for its decryption, which is not the behavior demonstrated by this script.

BBackdoor

A backdoor provides illicit remote access to a system, bypassing normal authentication, and this script does not create any such access mechanism.

CLogic bombCorrect

A logic bomb is a type of malicious code intentionally inserted into a software system that executes when specified conditions are met. In this script, the condition is `($members -notcontains "JohnDoe")`, and the malicious action is `Remove-Item -path C:\Database -recurse -force`, which triggers the deletion of a critical directory.

DTrojan

A Trojan disguises itself as legitimate software while performing malicious actions; while this script might be part of a larger Trojan, the specific mechanism of conditional execution and destructive payload described here is characteristic of a logic bomb rather than the disguise aspect of a Trojan.

Concept tested: Malware identification, logic bomb characteristics

Topics

#logic bomb#malware analysis#PowerShell#scheduled tasks

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice