An EDR alert shows PowerShell launching from a scheduled task, downloading encoded commands, and running them in memory. No suspicious executable is written to disk. What kind of attack is this?

A worm that spreads by exploiting a network service

Worms focus on propagation between systems, not necessarily in-memory execution through trusted scripting tools.

A logic bomb that waits for a specific date or event

Logic bombs are time- or event-triggered payloads, not attacks centered on PowerShell command download behavior.

A rootkit that changes kernel behavior to hide processes

Rootkits conceal malware and alter system visibility, but the alert describes in-memory script execution.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: A fileless attack that relies on trusted tools already on the system — The correct answer is a fileless attack. The important details are that PowerShell is being used, commands are encoded, and no malicious executable is saved to disk. Fileless attacks abuse legitimate administrative tools to reduce detection and may execute payloads only in memory. This makes them harder to find with traditional file-based antivirus, so behavior-based detection and script monitoring are important. Why others are wrong: A worm would be expected to spread laterally or autonomously across hosts, which is not what this alert shows. A logic bomb depends on a specific trigger such as a date or condition, and that is not described. A rootkit focuses on hiding itself and tampering with visibility, while this event is about PowerShell-based in-memory execution.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.