SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A SOC analyst sees repeated encoded PowerShell launched by mshta.exe. No new executable is written to disk, but the host makes periodic outbound connections to the same IP. Which malware characteristic is most likely?
⚠ Common exam trap
The trap here is that candidates see 'outbound connections' and immediately think of a worm or spyware, but the key differentiator is the lack of a written executable and the use of built-in tools in memory, which defines a fileless attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fileless attack, because the malicious activity lives in memory and uses built-in tools.
The scenario describes encoded PowerShell commands executed by mshta.exe without writing a new executable to disk, which is a classic fileless attack technique. Fileless malware operates entirely in memory, leveraging legitimate system tools (like PowerShell and mshta) to evade traditional antivirus detection, and the outbound connections are for command-and-control (C2) communication, not for self-propagation or data theft.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Fileless attack, because the malicious activity lives in memory and uses built-in tools.
Why this is correct
The malicious activity is executed entirely in memory via encoded PowerShell and mshta.exe, both of which are legitimate Windows binaries. This is the hallmark of a fileless attack: the payload never writes a separate executable to disk, so it evades traditional file-based antivirus scanning. By abusing built-in tools, the attacker achieves execution without leaving a persistent artifact, which is exactly what the evidence shows.
- ✗
Worm, because the host is making outbound connections to a remote system.
Why it's wrong here
Outbound connections to a remote IP address are a generic indicator of many malicious behaviors, but they do not define a worm. Worms are characterized by autonomous self-replication and lateral movement across systems, typically by exploiting network vulnerabilities or copying themselves to other hosts. Here, there is no evidence of scanning, propagation, or other hosts being affected, so calling this a worm is unjustified.
- ✗
Spyware, because the host is communicating with an external IP address.
Why it's wrong here
Spyware is typically installed as a persistent file on the system and then performs surveillance or data exfiltration. The strongest clues in this alert are the encoded script and the use of mshta.exe, which indicate in-memory execution rather than a dropped spyware payload. Communicating with an external IP is common to both spyware and fileless malware, but the absence of a disk-resident component points away from classic spyware behavior.
- ✗
Rootkit, because the system tools are being hidden from the user.
Why it's wrong here
A rootkit's defining characteristic is concealing itself and other malicious objects, often by hooking OS calls or modifying system structures so that files, processes, or network connections remain hidden. In this scenario, the evidence shows script-based execution and network communication, but nothing suggests that system tools are being hidden or that any stealth mechanism is active. The abuse of PowerShell and mshta.exe is a fileless attack pattern, not a rootkit's hiding technique.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Fileless malware
Fileless malware is a type of malicious activity that uses legitimate system tools and memory to execute attacks, leaving no traditional file on the hard drive.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.