SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A finance application works normally for weeks after a contractor leaves the company. On the first business day of the quarter, a hidden task runs, deletes archived reports, and then removes itself from the scheduled task list. What type of malware behavior is this?
⚠ Common exam trap
Many exam-takers confuse a logic bomb with a worm because both can execute code automatically, but they fail to recognize that a worm's defining characteristic is self-propagation across networks, not a delayed, condition-based trigger.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Logic bomb
The malware behavior described is a logic bomb because it lies dormant for a specific period (weeks) and triggers on a predefined condition (the first business day of the quarter) to execute a malicious payload (deleting archived reports) and then self-destructs by removing itself from the scheduled task list. This matches the definition of a logic bomb: malicious code that executes when a logical condition is met, often used for sabotage or delayed attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Worm
Why it's wrong here
A worm is self-replicating and propagates automatically across networks, often exploiting vulnerabilities, without needing a host file or user interaction. It doesn't remain dormant inside a finance application for weeks waiting for a specific date; its defining trait is autonomous spreading to other systems, not delayed malicious execution based on a trigger condition.
- ✓
Logic bomb
Why this is correct
A logic bomb is malicious code embedded within a legitimate application that remains inactive until a predefined condition is met, such as a specific date, an event, or an account status change. In this scenario, the finance application functioning normally for weeks and then suddenly deleting files aligns precisely with a time- or event-based trigger, making a logic bomb the most likely cause.
- ✗
Rootkit
Why it's wrong here
A rootkit is a set of tools designed to maintain privileged access and conceal its own presence or the presence of other malware, often by patching kernel modules or intercepting system calls. It does not inherently include a delayed trigger mechanism to delete files after a set period; its primary purpose is stealth and persistence, not scheduled destructive actions.
- ✗
Spyware
Why it's wrong here
Spyware is software that covertly gathers system or user data, such as keystrokes, browsing habits, or credentials, and typically transmits that information to a remote attacker. While spyware can cause performance issues and privacy breaches, it lacks a logic bomb's characteristic delayed, condition-based file destruction; its goal is surveillance, not timed sabotage.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Logic bomb
A logic bomb is a piece of malicious code that lies dormant inside a system until a specific condition or event triggers it to execute harmful actions.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.