SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
An EDR alert shows a Windows workstation used certutil.exe to download an encoded script, then created a scheduled task named UpdateCheck that runs every 15 minutes. The machine is also making short HTTPS connections to the same external IP. What is the best description of what the attacker is doing?
⚠ Common exam trap
Many exam-takers confuse the use of a native tool like certutil.exe with a buffer overflow or drive-by download, failing to recognize the living-off-the-land technique and persistence via scheduled tasks as the core indicators.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Living-off-the-land abuse with persistence through a scheduled task is occurring.
The attacker is using certutil.exe, a native Windows tool, to download an encoded script (living-off-the-land), and then creating a scheduled task named UpdateCheck to maintain persistence by running every 15 minutes. This combination of abusing trusted binaries and establishing a recurring task is a classic indicator of LOTL abuse with persistence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A buffer overflow exploit is likely corrupting memory in the operating system.
Why it's wrong here
Buffer overflow attacks typically involve malformed input crashing or hijacking a process through memory corruption, which is not shown here.
- ✓
Living-off-the-land abuse with persistence through a scheduled task is occurring.
Why this is correct
The attacker is using legitimate system utilities, such as certutil.exe and the Windows task scheduler, to download, execute, and persist malicious code. That pattern strongly suggests living-off-the-land abuse rather than a custom malware loader. The recurring outbound HTTPS traffic to a single external host also fits command-and-control activity. This combination is common when attackers want to blend in with normal administrative behavior and survive reboots without dropping obvious binaries.
- ✗
The evidence most strongly suggests a drive-by download from a compromised browser session.
Why it's wrong here
A drive-by download usually starts with a malicious website or browser exploit, not with explicit use of built-in administrative utilities and task creation.
- ✗
A man-in-the-middle attack is intercepting and modifying the TLS session.
Why it's wrong here
A TLS interception problem would usually present certificate warnings, proxy anomalies, or altered certificate chains, not scheduled task persistence and certutil usage.
Go deeper
Related to this question
Learn chapter
Cryptojacking and Resource Abuse
Key term
EDR alert
An EDR alert is a notification generated by Endpoint Detection and Response software when it detects potentially malicious activity or an anomaly on a device like a laptop, server, or workstation.
Key term
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol Secure, or HTTPS, is the secure version of HTTP that encrypts data between a web browser and a website using SSL/TLS to protect sensitive information like passwords and credit card numbers.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.