An EDR console shows PowerShell launching from a scheduled task, decoding a command from memory, and spawning rundll32.exe. No suspicious executable is written to disk, and the activity stops when the process ends. Which threat best fits this behavior?

Trojan downloader

A trojan usually relies on a malicious file or installer that appears legitimate.

Rootkit

A rootkit focuses on hiding presence or gaining deep persistence, often through system modifications.

Worm

A worm is designed to self-replicate across systems, which is not shown here.

What does this SY0-701 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Fileless malware — This activity matches fileless malware because the malicious behavior is occurring in memory and leveraging built-in administrative tools rather than dropping a new executable to disk. The use of PowerShell, encoded commands, and rundll32.exe is a common indicator of living-off-the-land techniques. Those techniques help attackers evade signature-based detection and complicate forensic recovery because there may be little or no obvious malware file to quarantine. Why others are wrong: A trojan downloader would normally involve a disguised malicious program or payload file, not purely memory-based execution. A rootkit is more about concealment and privileged persistence than the command-in-memory pattern shown. A worm is characterized by self-propagation to other hosts, but the prompt only describes execution on one system without spreading behavior.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.