SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
EDR summary: - Parent process: taskeng.exe - Child process: powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand ... - No new executable files were created in user profile folders - Scheduled task 'UpdateSvc' launches every 5 minutes - Outbound TLS connections to 198.51.100.77 occur immediately after execution
Based on the exhibit, what is the most likely explanation for the suspicious workstation activity?
⚠ Common exam trap
The trap here is that candidates see a PowerShell command and assume it is a worm or ransomware, but the key detail is the in-memory execution (no file written) which is the hallmark of a fileless attack, not the payload's ultimate goal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fileless attack
The exhibit shows a PowerShell command that downloads and executes a payload directly in memory without writing to disk. This is a classic indicator of a fileless attack, where malicious code runs in volatile memory (e.g., via PowerShell, WMI, or macros) to evade traditional file-based antivirus detection. The use of `Invoke-Expression` (IEX) with a remote URL confirms the attack vector is fileless.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ransomware campaign
Why it's wrong here
The exhibit lacks the hallmarks of ransomware: there is no evidence of mass file encryption, no modified file extensions, no dropped ransom note, and no user-visible extortion message. Instead, the activity centers on a scheduled task that invokes legitimate utilities running encoded PowerShell and maintains periodic beaconing, which points to stealthy access rather than a loud, data-holding attack. Ransomware would also produce significant disk I/O and immediate operational impact, while this behavior is deliberately quiet and low-volume.
- ✓
Fileless attack
Why this is correct
The exhibit shows legitimate Windows tools launching hidden, encoded PowerShell from a scheduled task, with no dropped executable on disk. That pattern strongly suggests a fileless attack, where the payload runs primarily in memory and uses trusted utilities to reduce visibility. The periodic connections after execution also fit a lightweight backdoor or loader rather than a traditional malware binary.
- ✗
Worm propagation
Why it's wrong here
Worm propagation depends on self-replication and lateral movement, such as scanning for vulnerable services, copying itself to remote hosts, or abusing SMB/SSH. The exhibit shows only a single host executing a scheduled task through PowerShell and making periodic outbound connections; there are no indicators of network scanning, dropped binaries on remote systems, or repeated spread across hosts. The observed beacons are consistent with a lightweight backdoor communicating with a command-and-control server, not with a worm's autonomous spreading activity.
- ✗
Rootkit persistence
Why it's wrong here
A rootkit typically establishes persistence by loading a kernel driver, bootkit, or hypervisor component, and it hooks system APIs or hides its own files, processes, and registry keys from the OS. This exhibit shows no driver installation, no exploitation of kernel-level mechanisms, and no evidence of API hooking or rootkit utilities; the concealment comes from executing an encoded PowerShell payload entirely in memory via a scheduled task. That is userland, script-based evasion, not the OS-level stealth that defines a true rootkit.
Go deeper
Related to this question
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, what type of threat is the security team most likely seeing on the workstation?
easy- A.Trojan
- ✓ B.Fileless malware
- C.Worm
- D.Rootkit
Why B: The security team is most likely seeing fileless malware because the exhibit shows a PowerShell command that injects malicious code directly into memory (e.g., using Invoke-Mimikatz or a reflective DLL injection technique) without writing a persistent executable to disk. Fileless malware operates in-memory, leveraging legitimate system tools like PowerShell, WMI, or .NET to evade traditional signature-based antivirus detection, which matches the scenario described.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.