A “logic bomb” inside a Trojan triggers its malicious activity based on which…
2026
A “logic bomb” inside a Trojan triggers its malicious activity based on which of the following?
Answer: D. A specific time or system condition — ConceptA logic bomb is malicious code planted inside a program (such as a Trojan) that remains dormant, causing no harm, until a specific triggering condition…
- A.
The malware replicating itself automatically and spreading to other systems without attaching to any host file
- B.
The malicious code attaching itself to a legitimate host program and activating only when that host program is run
- C.
The program exploiting a software vulnerability to give an attacker unauthorized remote access as soon as it is installed
- D.
A specific time or system condition
Attempted by 3 students.
Show answer & explanation
Correct answer: D
Concept
A logic bomb is malicious code planted inside a program (such as a Trojan) that remains dormant, causing no harm, until a specific triggering condition — a date/time or a defined system state/event — is satisfied. This conditional, delayed activation is what distinguishes a logic bomb, as a malware category, from malware types that are instead defined by HOW they spread or gain access (such as worms, viruses, or backdoors).
Application
Applying this to the question: the Trojan's hidden payload (the logic bomb) does not fire the moment the Trojan is installed. It waits and monitors for a defined trigger — reaching a particular date or elapsed time, a specific system event occurring (for example, a particular user account being removed), or the system reaching a defined state. Only when that time or system condition is met does the payload activate.
Cross-check
Checking the other options confirms each describes a DIFFERENT malware category's defining trait, not a triggering condition for a dormant payload:
Automatic self-replication across systems without attaching to a host file describes a worm, which spreads on its own rather than waiting on a pre-set trigger.
Attaching to a host program and activating only when that host program runs describes a virus — its activation depends on the host executing, not on a specific date/event condition.
Gaining unauthorized remote access immediately upon installation by exploiting a vulnerability describes a remote-access exploit, which acts right away rather than waiting on a pre-set condition.
So the logic bomb's activation is governed specifically by a time or system condition being met, distinguishing it from the propagation- and access-based malware behaviours described above.