SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A finance laptop is opened to review an invoice attachment. EDR then shows winword.exe launching powershell.exe with hidden, no-profile, and base64-encoded arguments. No executable is written to disk, network beacons begin from memory, and after a reboot the activity disappears unless the document is opened again. What type of malware behavior is most likely?
⚠ Common exam trap
A common mix-up: candidates confuse the initial infection vector (opening an invoice) with the malware type (ransomware), but the key behavioral indicator is the in-memory execution and lack of disk artifacts, which points to fileless malware, not ransomware.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fileless attack, because malicious code runs in memory and leaves little or no executable artifact on disk.
The scenario describes malicious code that executes entirely in memory without writing an executable to disk, which is the defining characteristic of a fileless attack. Winword.exe launching PowerShell with hidden, no-profile, and base64-encoded arguments is a classic technique to load and execute payloads directly in memory, bypassing traditional file-based detection. The fact that activity disappears after reboot unless the document is reopened confirms that no persistent artifact remains on disk, further supporting fileless behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Worm behavior, because the infection would self-replicate across systems through the network.
Why it's wrong here
A worm's definitive behavior is autonomous, self-propagating replication across hosts via network vulnerabilities or file-sharing mechanisms. In this scenario, there is no evidence of lateral movement, network propagation, or attempts to infect other systems — only a local, in-memory execution chain. The document-triggered PowerShell launch and subsequent beaconing are hallmarks of a single-host fileless infection, not a worm.
- ✓
Fileless attack, because malicious code runs in memory and leaves little or no executable artifact on disk.
Why this is correct
This is a classic fileless attack pattern. The process chain from a trusted Office app to hidden PowerShell, the encoded command line, the lack of a new binary on disk, and the disappearance after reboot all point to code executing primarily in memory. That makes detection harder and often means the initial document or script acts as the launcher rather than a traditional dropper.
- ✗
Rootkit behavior, because the malware is hidden from normal user-mode tools.
Why it's wrong here
Rootkit behavior specifically involves subverting the operating system at kernel or user level to hide processes, files, or registry keys from standard tools. Here, the indications are process-level anomalies and encoded PowerShell commands, not stealth techniques like API hooking or driver-level tampering. Additionally, a rootkit would typically persist across reboots to maintain concealment; the malware's disappearance after reboot contradicts that persistence requirement, making rootkit an inaccurate classification.
- ✗
Ransomware, because the user opened an invoice attachment before the suspicious activity started.
Why it's wrong here
Although invoice attachments are a classic phishing lure for ransomware, the symptom set here does not match ransomware's operational fingerprint. Ransomware would produce mass file encryption, altered file extensions, and a ransom note, along with a clear intent to extort the victim. In contrast, the observed indicators are in-memory code execution and command-and-control beaconing, which align with data exfiltration or espionage rather than an immediate encryption-based extortion scheme.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
EDR
Endpoint Detection and Response (EDR) is a cybersecurity technology that continuously monitors endpoint devices to detect, investigate, and respond to advanced threats.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user opens an attached document, and the endpoint security tool shows PowerShell running from memory with no new executable file written to disk. What type of attack is most likely?
easy- ✓ A.Fileless attack
- B.Ransomware
- C.Rootkit
- D.Logic bomb
Why A: The scenario describes PowerShell running from memory without a new executable file written to disk, which is the hallmark of a fileless attack. Fileless attacks leverage legitimate system tools like PowerShell, WMI, or .NET to execute malicious code directly in memory, bypassing traditional file-based detection mechanisms.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.