SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
An EDR alert shows powershell.exe launching with an encoded command, no new executable written to disk, and a registry run key added for persistence. Outbound HTTPS traffic then begins to a rare external domain. Which type of malware behavior is most likely?
⚠ Common exam trap
The trap here is that candidates see 'HTTPS traffic to an external domain' and jump to spyware (Option D), but the question's emphasis on 'no new executable written to disk' and 'encoded command' points directly to fileless attack, not data exfiltration as the primary behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fileless attack, because the malicious activity is using legitimate tools and memory rather than a dropped payload.
The EDR alert describes a classic fileless attack: PowerShell.exe executes an encoded command in memory, no new executable is written to disk, and persistence is achieved via a registry run key. The outbound HTTPS traffic to a rare domain indicates command-and-control (C2) communication. Fileless malware leverages legitimate system tools (like PowerShell) and runs entirely in memory, bypassing traditional file-based detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Worm behavior, because the malware is automatically spreading across the network.
Why it's wrong here
Worm behavior requires self-replication and active propagation across network hosts, typically via OS or application vulnerabilities. The EDR alert shows no evidence of scanning, lateral movement, or worm-like spread; it describes a localized PowerShell process with encoded arguments and a registry run key, which are classic fileless execution and persistence indicators.
- ✓
Fileless attack, because the malicious activity is using legitimate tools and memory rather than a dropped payload.
Why this is correct
The alert shows encoded PowerShell, no new file on disk, and persistence through a registry run key. That pattern strongly suggests a fileless attack, where attackers abuse trusted system tools and memory-based execution to avoid traditional file detection.
- ✗
Rootkit behavior, because the attacker is hiding from the operating system at a low level.
Why it's wrong here
Rootkits operate at kernel or privileged layers to hide malware artifacts from the OS, often by hooking system calls or patching boot components. The alert's evidence points to user-mode PowerShell script execution and registry-based persistence, not kernel-level stealth, so mislabeling this as rootkit behavior overlooks the actual in-memory, living-off-the-land technique.
- ✗
Spyware, because the malware is using HTTPS traffic to contact an external domain.
Why it's wrong here
Spyware is specifically designed to covertly gather user information, such as keystrokes, screenshots, or browsing habits, and exfiltrate it. Although outbound HTTPS to an external domain could be consistent with spyware, the encoded PowerShell and registry persistence are far more precise indicators of a fileless attack, and the alert does not mention any data collection or exfiltration functionality.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
EDR alert
An EDR alert is a notification generated by Endpoint Detection and Response software when it detects potentially malicious activity or an anomaly on a device like a laptop, server, or workstation.
Key term
EDR
Endpoint Detection and Response (EDR) is a cybersecurity technology that continuously monitors endpoint devices to detect, investigate, and respond to advanced threats.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.