A SOC analyst reviews an EDR alert on a Windows workstation. PowerShell was launched by a scheduled task, downloaded an encoded command from an external server, and then spawned rundll32.exe. No suspicious executable was written to disk. Which type of threat best fits this activity?

Trojan

A trojan usually disguises itself as legitimate software, but this alert emphasizes in-memory execution and no dropped file.

Rootkit

A rootkit focuses on hiding malicious activity or gaining deep persistence, which is not the primary clue in this alert.

Worm

A worm self-replicates across systems, but this evidence points to command execution from memory on a single host.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Fileless attack — This behavior best matches a fileless attack because the malicious activity is using legitimate scripting and system utilities to execute code in memory. PowerShell and rundll32.exe are commonly abused to avoid dropping obvious malware files on disk, which helps evade many signature-based tools. The scheduled task also suggests persistence through normal administrative features rather than a standalone executable. The key clues are encoded commands, trusted binaries, and no suspicious file creation. Why others are wrong: A trojan would usually involve a disguised malicious program being installed or executed, which is not indicated here. A rootkit is aimed at concealment and low-level persistence, not simply in-memory script execution. A worm is designed to spread automatically across systems, but the scenario only shows malicious execution on one workstation and gives no sign of self-propagation.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.