Alekos runs the accounting systems for his company. The morning after an essential employee was fired, systems began mysteriously losing information. Alekos suspects that the fired employee tampered with the systems prior to his departure. What type of attack should Alekos suspect?

The critical fact in this question is that Alekos suspects the tampering took place before the employee departed. This is the signature of a logic bomb: malicious code that lies dormant until certain conditions are met. The other attack types listed here—privilege escalation, SQL injection, and remote code execution—would more likely take place in real time.