Online Access Free SY0-701 Exam Questions

No.# The code shown is a logic bomb — it triggers on a specific date and then executes a destructive action (DROP DATABASE).
Since the website became unusable right after midnight on that exact date, the code clearly executed as intended.

Given this, the analyst’s next step should be:

✔ B. Check for recently terminated DBAs.
Why this is the correct next step
A logic bomb is almost always:

Inserted intentionally

By someone with privileged access

Often by a disgruntled or recently terminated employee

DBAs or developers with database‑level permissions are the only ones who could insert such code into a backup routine.
Because the trigger date matches the outage exactly, this strongly suggests insider sabotage.

Why the other options are not the best next step
A. Search the web server for ransomware notes
This is not ransomware — ransomware encrypts data and demands payment.
This code simply deletes the database on a specific date.

C. Review WAF logs for command injection
Command injection would not insert a scheduled logic bomb into backup code.
This was placed intentionally in the script, not injected via HTTP.

D. Scan the database server for malware
This is not malware; it is a malicious insider‑placed script.

Final Answer: B. Check for recently terminated DBAs....