SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A SOC analyst reviews an alert on a workstation where PowerShell launched from a scheduled task, downloaded an encoded command from a remote server, and then spawned rundll32.exe. Traditional antivirus did not flag any files on disk, and the activity stops after rebooting the host. Which type of malware behavior best fits this event?
⚠ Common exam trap
The trap here is that candidates may associate any scheduled task or PowerShell activity with a worm or Trojan, but the key differentiator is the absence of disk writes and the use of memory-only execution, which is the defining characteristic of a fileless attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fileless attack using trusted system tools to run malicious code in memory
The attack uses PowerShell to download and execute an encoded command directly in memory, then spawns rundll32.exe—both are trusted Microsoft binaries. No files are written to disk, and the activity ceases after reboot, which are hallmarks of a fileless malware attack that operates entirely in volatile memory.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Worm behavior that is spreading through SMB shares
Why it's wrong here
Worms self-replicate by exploiting network services such as SMB (e.g., EternalBlue/MS17-010) and automatically copying their payload to remote hosts. The alert shows a single workstation running PowerShell that fetches and executes code in memory; there is no observed propagation to other systems, no SMB-specific network connections, and no creation of file shares or service requests. Therefore, the behavior is isolated and does not match the lateral-spreading signature of a worm.
- ✓
Fileless attack using trusted system tools to run malicious code in memory
Why this is correct
This matches a fileless attack because the malicious activity relies on built-in tools like PowerShell and rundll32 rather than an obvious executable on disk. The alert shows code being fetched and executed from memory, which often evades traditional file-based antivirus detection. The fact that the behavior disappears after reboot further supports a memory-resident, fileless technique.
- ✗
Rootkit that is hiding itself by modifying kernel drivers
Why it's wrong here
Rootkits are designed to actively conceal their presence, often by loading a kernel driver that hooks system calls, filters device I/O, or manipulates kernel objects via DKOM to hide processes, files, and registry keys. Nothing in this alert indicates kernel-level tampering, no suspicious driver is loaded, and the activity is visible as userland PowerShell and rundll32 processes fetching remote content into memory. A rootkit would prioritize stealth and persistence after reboot, whereas this behavior disappears after reboot and shows no evidence of driver installation.
- ✗
Trojan that can only run after a user manually opens a malicious attachment
Why it's wrong here
While a trojan often arrives via a malicious attachment, it normally drops or installs a standalone executable or script file onto disk, and running it typically requires explicit user interaction such as double-clicking an attached binary. This alert shows PowerShell downloading and executing code directly in memory with no on-disk payload, which is characteristic of a fileless or script-based attack rather than a classic trojan. Moreover, the alert does not specify that a user opened an attachment; the initial vector is just as likely to be a malicious macro, a URL, or a scripted exploit.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Fileless malware
Fileless malware is a type of malicious activity that uses legitimate system tools and memory to execute attacks, leaving no traditional file on the hard drive.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.