SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A SOC analyst reviews an EDR alert on a Windows workstation. PowerShell was launched by a scheduled task, downloaded an encoded command from an external server, and then spawned rundll32.exe. No suspicious executable was written to disk. Which type of threat best fits this activity?
⚠ Common exam trap
The trap here is that candidates see 'downloaded an encoded command' and assume a file was written, but the key distinction is that no executable file was written to disk, making it a fileless attack rather than a Trojan or rootkit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fileless attack
The attack is fileless because it executes entirely in memory without writing a malicious executable to disk. PowerShell downloads an encoded command from an external server and spawns rundll32.exe to run code via DLL execution, leveraging living-off-the-land binaries (LOLBins) to evade traditional antivirus and disk-based detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Trojan
Why it's wrong here
A trojan is malware that disguises itself as legitimate software to trick users into executing it. However, the EDR alert emphasizes in-memory execution with no dropped file, which is atypical for a trojan because trojans typically rely on a file-based payload that persists on disk. The absence of a malicious executable and the use of PowerShell or similar living-off-the-land tools point away from a trojan classification. Thus, while a trojan might use memory execution as a later stage, the initial infection vector and primary artifact here are not consistent with a classic trojan.
- ✓
Fileless attack
Why this is correct
This is the correct classification. Fileless attacks leverage trusted system tools (e.g., PowerShell, WMI, or .NET) to execute malicious code directly in memory, avoiding writing an executable to disk. The alert's focus on in-memory execution and the absence of a dropped file are hallmarks of this technique. These attacks are particularly dangerous because they leave few forensic traces, evade signature-based detection, and often exploit legitimate administrative capabilities.
- ✗
Rootkit
Why it's wrong here
A rootkit is designed to hide malicious activity or maintain stealthy persistence, often by manipulating the kernel or system APIs to conceal processes, files, or network connections. While some rootkits also operate in memory, the primary indicator in this alert—command execution via PowerShell from memory on a single host—does not specifically suggest rootkit behavior. The core purpose of a rootkit is to provide covert access, not simply to run a payload in memory, so the evidence here is insufficient to classify it as a rootkit.
- ✗
Worm
Why it's wrong here
A worm is a self-replicating malware that spreads autonomously across networks by exploiting vulnerabilities or using built-in propagation techniques. The EDR alert describes a single Windows workstation with in-memory command execution, showing no indication of self-replication or lateral movement. While a worm might execute code in memory as part of its lifecycle, the evidence presented is focused on a one-off execution, not network propagation, making worm classification inaccurate.
Go deeper
Related to this question
Learn chapter
Network-Based Attacks
Key term
EDR alert
An EDR alert is a notification generated by Endpoint Detection and Response software when it detects potentially malicious activity or an anomaly on a device like a laptop, server, or workstation.
Key term
EDR
Endpoint Detection and Response (EDR) is a cybersecurity technology that continuously monitors endpoint devices to detect, investigate, and respond to advanced threats.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.