SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
An administrator notices that a finance file share remained normal for weeks after a former contractor left the company. This morning, multiple PDFs and spreadsheets were deleted, and a scheduled task created months ago is now executing a script that wipes files in the shared folder. Which malware type is most consistent with this behavior?
⚠ Common exam trap
Many exam-takers confuse a logic bomb with a worm because both can cause widespread damage, but the key distinction is the pre-planted, dormant nature of the logic bomb versus the active self-propagation of a worm.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Logic bomb triggered by a time or condition after being planted earlier
The behavior matches a logic bomb: malicious code planted in advance (the scheduled task created months ago) that remains dormant until triggered by a specific condition (the passage of time or a date). The file share was normal for weeks because the logic bomb had not yet met its trigger condition; once triggered, it executed the script to delete files. This contrasts with other malware types that require active propagation, continuous monitoring, or kernel-level hiding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Logic bomb triggered by a time or condition after being planted earlier
Why this is correct
A logic bomb is the best fit because malicious code was planted earlier and remained dormant until a trigger condition caused it to execute. The scheduled task and delayed destructive action are classic signs of a hidden payload designed to activate later, sometimes after a user departure, date, or system event. The time gap strongly supports this interpretation.
- ✗
Worm that is automatically propagating to other endpoints
Why it's wrong here
A worm is self-replicating malware that spreads autonomously across network shares and hosts without needing a pre-planted trigger or a waiting period. This scenario describes a single file share behaving normally for weeks before a destructive action occurs, which is inconsistent with worm propagation, and there is no evidence of lateral movement, replication, or network scanning. The delayed activation after a user departure is the hallmark of a logic bomb, not a worm.
- ✗
Spyware that is secretly collecting keystrokes and screenshots
Why it's wrong here
Spyware is designed to covertly gather intelligence—such as keystrokes, screenshots, browsing habits, or credentials—and typically exfiltrates that data continuously or periodically. It does not delete files or wait dormant for weeks before launching a destructive payload, and its value depends on ongoing collection rather than a one-time trigger. The file share's normal behavior until a sudden destructive event better matches a logic bomb's conditional activation than spyware's surveillance mission.
- ✗
Rootkit that is hiding itself in the kernel to maintain stealth
Why it's wrong here
A rootkit operates at kernel or privileged levels to hide its own presence, maintain stealth, and preserve attacker access, often by intercepting system calls or masking processes and files. While it can enable later malicious activity, the rootkit itself does not contain a scheduled destructive event that deletes files on a finance share after a specific condition. The key here is the delay and trigger—rootkits are persistence and evasion tools, whereas the described incident is an activated destructive payload, characteristic of a logic bomb.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Logic bomb
A logic bomb is a piece of malicious code that lies dormant inside a system until a specific condition or event triggers it to execute harmful actions.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A finance application works normally for weeks after a contractor leaves the company. On the first business day of the quarter, a hidden task runs, deletes archived reports, and then removes itself from the scheduled task list. What type of malware behavior is this?
medium- A.Worm
- ✓ B.Logic bomb
- C.Rootkit
- D.Spyware
Why B: The malware behavior described is a logic bomb because it lies dormant for a specific period (weeks) and triggers on a predefined condition (the first business day of the quarter) to execute a malicious payload (deleting archived reports) and then self-destructs by removing itself from the scheduled task list. This matches the definition of a logic bomb: malicious code that executes when a logical condition is met, often used for sabotage or delayed attacks.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.