SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A fileless attack that relies on trusted tools already on the system

  Why this is correct

  A fileless attack uses legitimate, already-trusted system tools such as PowerShell to execute malicious code directly in memory, avoiding writing an executable to disk. The scheduled task provides persistence or a trigger, and the EDR alert reflects behavioral detection of an abnormal PowerShell invocation chain, such as downloading and running a payload via IEX or reflection. Because no traditional malware file exists, antivirus scanners that rely on file signatures often miss it, making the use of trusted tooling a hallmark of fileless technique.

• ✗

  A worm that spreads by exploiting a network service

  Why it's wrong here

  A worm's defining characteristic is self-propagation: it actively scans for and exploits vulnerable network services on remote hosts, then copies itself to those systems to continue spreading. In this alert, there is no evidence of outbound scanning, exploitation of SMB/RDP, or lateral movement; instead, the indicator is a single PowerShell process initiated by a scheduled task on one host. While PowerShell could theoretically be used for worm activity, the described behavior lacks the propagation loop and network artifact signature that would distinguish a worm.

• ✗

  A logic bomb that waits for a specific date or event

  Why it's wrong here

  A logic bomb is malicious code embedded within a legitimate application that lies dormant until a specific date, time, or user action triggers its payload. The alert here shows PowerShell launching from a scheduled task, which could be a trigger mechanism, but the note specifically mentions command download behavior; a logic bomb typically executes its destructive payload (e.g., deleting files, corrupting databases) rather than relying on in-memory script execution via interpreted runspaces. Without evidence of a pre-implanted dormant code path inside an existing program, classifying this as a logic bomb overreaches the observed telemetry.

• ✗

  A rootkit that changes kernel behavior to hide processes

  Why it's wrong here

  A rootkit operates at a low level—often in kernel mode—to intercept system calls, hide malicious processes, files, and registry keys, and maintain stealthy persistence while evading security tools. The EDR alert describes PowerShell launching from a scheduled task, which is userland script activity, and provides no indication of kernel object manipulation, SSDT hooking, or process/network concealment. Rootkits typically require privilege escalation and driver loading to alter kernel behavior, not simply a scheduled PowerShell command execution.

Go deeper

Related to this question