An EDR console shows `mshta.exe` launching `powershell.exe` from a user profile directory, followed by a script that never writes a new executable to disk. Minutes later, the host begins making regular outbound HTTPS connections to an unfamiliar IP address. What type of malware behavior is most likely being observed?

Ransomware

Ransomware typically encrypts data and often leaves obvious file-access disruption or ransom notes, which are not described here.

Worm

A worm is designed for self-replication across systems, but the key clue here is the diskless execution chain rather than propagation.

Rootkit

A rootkit focuses on hiding processes, files, or drivers after compromise. That is not the primary behavior shown by the PowerShell execution pattern.

What does this SY0-701 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Fileless attack — The correct answer is fileless attack. The chain of mshta launching PowerShell, combined with no new executable being written to disk, is a classic sign that the attacker is using legitimate system tools to execute malicious code. The regular outbound HTTPS traffic suggests command-and-control communication. This pattern is harder to detect with simple file-based scanning and is commonly associated with living-off-the-land techniques. Why others are wrong: Ransomware would usually cause visible file encryption, inaccessible data, or a ransom note. A worm is defined by self-spreading behavior, which is not the main clue in this scenario. A rootkit hides or masks attacker presence, but the question focuses on diskless execution and suspicious scripting, which better matches a fileless attack.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.