SY0-501 · Question #522
A security administrator is reviewing the following PowerShell script referenced in the Task Scheduler on a database server: $members = GetADGroupMemeber -Identity "Domain Admins" -Recursive |…
The correct answer is C. Logic bomb. The PowerShell script represents a logic bomb because it contains malicious code that is programmed to execute a destructive action only when a specific condition (JohnDoe not being a Domain Admin) is met, leveraging the Task Scheduler for conditional execution.
Question
A security administrator is reviewing the following PowerShell script referenced in the Task Scheduler on a database server:
$members = GetADGroupMemeber -Identity "Domain Admins" -Recursive | Select - ExpandProperty name if ($members -notcontains "JohnDoe"){ Remove-Item -path C:\Database -recurse -force } Which of the following did the security administrator discover?
Options
- ARansomeware
- BBackdoor
- CLogic bomb
- DTrojan
How the community answered
(23 responses)- A13% (3)
- B4% (1)
- C78% (18)
- D4% (1)
Why each option
The PowerShell script represents a logic bomb because it contains malicious code that is programmed to execute a destructive action only when a specific condition (JohnDoe not being a Domain Admin) is met, leveraging the Task Scheduler for conditional execution.
Ransomware typically encrypts data and demands a ransom for its decryption, which is not the behavior demonstrated by this script.
A backdoor provides illicit remote access to a system, bypassing normal authentication, and this script does not create any such access mechanism.
A logic bomb is a type of malicious code intentionally inserted into a software system that executes when specified conditions are met. In this script, the condition is `($members -notcontains "JohnDoe")`, and the malicious action is `Remove-Item -path C:\Database -recurse -force`, which triggers the deletion of a critical directory.
A Trojan disguises itself as legitimate software while performing malicious actions; while this script might be part of a larger Trojan, the specific mechanism of conditional execution and destructive payload described here is characteristic of a logic bomb rather than the disguise aspect of a Trojan.
Concept tested: Malware identification, logic bomb characteristics
Topics
Community Discussion
No community discussion yet for this question.