An endpoint investigation shows winword.exe launching powershell.exe with -nop -w hidden -enc arguments. The same host also has a newly created WMI permanent event subscription, and no new executable has appeared in Downloads or Program Files. Which two findings are most consistent with a fileless compromise and persistence mechanism? Select two.

A new executable named updater.exe was copied into Program Files by an administrator.

A new executable in Program Files could be legitimate software maintenance, especially if installed by an administrator through a normal process. Without additional suspicious behavior such as odd parent processes, malicious signatures, or unusual network traffic, this is not strong evidence of a fileless compromise.

The browser cache was cleared after a routine user sign-out.

Browser cache clearing is a common user or system action and does not indicate malware on its own. It has no direct relationship to fileless execution or persistence. This detail is operationally ordinary and would not be prioritized as a compromise indicator during endpoint triage.

A signed video driver updated successfully through Windows Update.

A signed driver update through Windows Update is typically legitimate maintenance and usually lowers risk rather than increasing it. Although drivers can be abused in some attacks, this scenario lacks the hallmarks of malicious persistence, script staging, or fileless execution that the other correct choices provide.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: PowerShell was launched with encoded, hidden execution arguments from a document process. — The two correct findings show a classic fileless chain. Encoded PowerShell started by Word suggests script-based execution rather than a dropped payload. The WMI permanent event subscription indicates stealthy persistence that can run after reboot without an obvious executable. Together, these artifacts fit modern malware that avoids writing traditional binaries while maintaining long-term control of the endpoint. Why others are wrong: A copied executable, browser cache clearing, and a signed driver update are all plausible benign activities in many environments. None of them directly shows script-based execution, persistence, or covert tradecraft. The key evidence here is the combination of suspicious PowerShell use and WMI persistence, not ordinary file activity or routine patching.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.