A contractor's access ends Friday, and Saturday morning a script on a records server deletes selected case files. Which malware pattern does this most clearly illustrate?
Select an answer to reveal the explanation.
Short Explanation
A logic bomb is the delayed trapdoor—set the condition, walk away, and the payload fires later. Here the trigger was the contractor's last day, not a spray attack or a DNS trick.
Full Explanation
A logic bomb is malicious code designed to activate when a specified condition or time occurs. When a contractor’s access ends Friday and Saturday morning a script on a records server deletes selected case files, the pattern is delayed, condition-triggered sabotage—commonly employment-end or date-based. Municipal records integrity is directly at stake because the payload waits until privileged monitoring and the contractor’s presence are gone.
Password spraying against many municipal accounts at once is an authentication attack distributing few guesses across many identities; it does not explain a scheduled delete script on a records server. DNS cache poisoning that redirects the payroll portal corrupts name resolution toward fraudulent sites; it does not delete case files after an employment-end condition. Amplified DDoS traffic aimed at the public website saturates availability with reflected traffic; it is unrelated to timed file deletion on an internal records host.
Exam caveat: distinguish logic bombs from ransomware and worms by the trigger model. Logic bombs emphasize “fire when condition X is met,” not continuous encryption-for-ransom or autonomous VLAN hopping. Employment termination and date triggers are classic exam examples.
Operational check: disable remaining contractor accounts and shared service credentials immediately, restore case files from verified backups, review scheduled tasks and scripts on records servers for other triggers, tighten privileged access reviews for departing personnel, and alert legal/records custodians about potential spoliation concerns.