SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A SOC analyst investigates a host after an employee opens an invoice attachment. The endpoint shows PowerShell running in a hidden window, no new executable files are created on disk, and the same suspicious activity returns after a reboot. What is the most likely attack type?
⚠ Common exam trap
Many candidates confuse 'fileless' with 'no persistence' or assume any attachment-based attack is ransomware, but the key indicators—hidden PowerShell, no new executables, and post-reboot persistence—point directly to a fileless attack using native Windows tools.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fileless attack, because the malicious activity is operating primarily in memory and using native tools.
The attack is fileless: it runs PowerShell in a hidden window without writing new executables to disk, and persistence after reboot indicates the malicious code is stored in the registry or a script that loads into memory at startup. Fileless attacks leverage native tools like PowerShell, WMI, or .NET to execute payloads entirely in memory, bypassing traditional file-based detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Fileless attack, because the malicious activity is operating primarily in memory and using native tools.
Why this is correct
Fileless attacks rely on legitimate scripting engines and memory-resident techniques instead of dropping obvious executable files. Hidden PowerShell activity, repeated behavior after reboot, and the absence of a new binary are strong signs that the attacker is leveraging trusted operating system components. This approach often helps malware evade traditional file-based scanning while still achieving persistence or command execution.
- ✗
Ransomware, because the user opened an email attachment.
Why it's wrong here
Ransomware would typically result in encrypted user files, a ransom note, and modified file extensions or denied access to data — none of which are described. The employee opening an email attachment only explains the initial infection vector, not the malware's classification. The observed signs of hidden PowerShell activity, memory-resident execution, and persistence without a new binary indicate fileless malware, not file-encrypting ransomware.
- ✗
Worm, because PowerShell is a common scripting tool.
Why it's wrong here
Worms are defined by their ability to self-replicate and propagate autonomously across systems, often exploiting network services or emailing themselves to contacts. Sharing a scripting tool like PowerShell does not make an attack a worm; the scenario shows no lateral movement, network scanning, or evidence of independent replication. The focus on memory-only execution and use of native tools points to fileless malware rather than a self-spreading worm.
- ✗
Rootkit, because the attacker is hiding the process from normal tools.
Why it's wrong here
Rootkits operate by subverting an operating system's core functions, such as kernel modules or API hooks, to conceal malicious activity from user-mode tools and system monitors. While process hiding can be a rootkit behavior, the key indicators here are the execution of PowerShell in memory and the reliance on legitimate system tools, not kernel-level manipulation. The absence of reports that standard tools are being deceived and the emphasis on memory-resident/native tool usage align with fileless malware, not a rootkit.
Go deeper
Related to this question
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.