SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
An endpoint investigation shows winword.exe launching powershell.exe with -nop -w hidden -enc arguments. The same host also has a newly created WMI permanent event subscription, and no new executable has appeared in Downloads or Program Files. Which two findings are most consistent with a fileless compromise and persistence mechanism? Select two.
⚠ Common exam trap
Watch out — candidates often think any persistence mechanism (like a new executable in Program Files) is fileless, but fileless specifically means no executable written to disk, and WMI subscriptions are a common fileless persistence vector.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PowerShell was launched with encoded, hidden execution arguments from a document process.
The use of winword.exe to launch powershell.exe with `-nop -w hidden -enc` arguments is a classic fileless execution technique. The encoded command runs entirely in memory without writing a payload to disk, and the launch from a document process (winword.exe) indicates a macro or exploit-based initial access, consistent with a fileless compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
PowerShell was launched with encoded, hidden execution arguments from a document process.
Why this is correct
Encoded and hidden PowerShell launched from a document process is a strong fileless malware indicator. The attack uses built-in scripting rather than dropping a traditional executable, which helps evade file-based detections. In combination with a user-facing process like Word, this pattern commonly suggests initial execution through malicious content or macro abuse.
- ✓
A WMI permanent event subscription was created under the root\subscription namespace.
Why this is correct
A WMI permanent event subscription is a well-known persistence technique because it can survive reboots without requiring a visible startup entry or common scheduled task. Attackers often use WMI to keep a foothold while remaining difficult to notice in routine file-system checks. It strongly supports a stealthy, script-based compromise.
- ✗
A new executable named updater.exe was copied into Program Files by an administrator.
Why it's wrong here
A new executable in Program Files could be legitimate software maintenance, especially if installed by an administrator through a normal process. Without additional suspicious behavior such as odd parent processes, malicious signatures, or unusual network traffic, this is not strong evidence of a fileless compromise.
- ✗
The browser cache was cleared after a routine user sign-out.
Why it's wrong here
Browser cache clearing is a common user or system action and does not indicate malware on its own. It has no direct relationship to fileless execution or persistence. This detail is operationally ordinary and would not be prioritized as a compromise indicator during endpoint triage.
- ✗
A signed video driver updated successfully through Windows Update.
Why it's wrong here
A signed driver update through Windows Update is typically legitimate maintenance and usually lowers risk rather than increasing it. Although drivers can be abused in some attacks, this scenario lacks the hallmarks of malicious persistence, script staging, or fileless execution that the other correct choices provide.
Go deeper
Related to this question
Learn chapter
Network-Based Attacks
Key term
Persistence
Persistence is the set of techniques attackers use to maintain long-term access to a compromised system even after reboots or credential changes.
Key term
Exploit
An exploit is a piece of code, a sequence of commands, or a technique that takes advantage of a vulnerability in a system or software to cause unintended behavior, often for malicious purposes.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.