SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
EDR timeline from a finance laptop: 08:14:02 winword.exe launched powershell.exe 08:14:03 powershell.exe executed with arguments: -WindowStyle Hidden -NoProfile -EncodedCommand SQBFAFgAKAAuLi4= 08:14:05 No new executable written to disk 08:14:08 Outbound HTTPS connection to 198.51.100.77 over port 443 08:14:11 User reports a document opened normally, but the machine began showing unusual network activity
Based on the exhibit, what type of malware behavior is most likely occurring?
⚠ Common exam trap
The trap here is that candidates see an outbound connection and immediately assume ransomware or spyware, but the key indicator is PowerShell executing in memory with no disk write, which is the defining characteristic of a fileless attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fileless attack, because PowerShell was launched in memory with no new payload written to disk.
The exhibit shows PowerShell being launched in memory with no new payload written to disk, which is the hallmark of a fileless attack. Fileless malware exploits legitimate system tools like PowerShell to execute malicious code directly in memory, evading traditional signature-based detection that relies on scanning files on disk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ransomware, because the endpoint made an outbound connection after opening a document.
Why it's wrong here
Ransomware is characterized by file encryption, ransom notes, and mass renaming of user files. While an outbound connection after opening a document could be staging or command-and-control traffic, the exhibit lacks any encryption artifacts or extortion indicators. The presence of an encoded PowerShell command executed in memory strongly indicates a script-based, fileless attack, not encryption-based ransomware.
- ✓
Fileless attack, because PowerShell was launched in memory with no new payload written to disk.
Why this is correct
This is a fileless attack because the malicious activity relies on script execution rather than a traditional dropped executable. The encoded PowerShell command, hidden execution, and absence of a new file on disk strongly indicate memory-based or script-based malware behavior that can evade basic file scanning.
- ✗
Spyware, because the laptop made an encrypted outbound connection.
Why it's wrong here
Spyware operations rely on covert collection of credentials, keystrokes, browsing habits, or screen captures, typically exfiltrating them to an attacker. An encrypted outbound channel alone is insufficient evidence for spyware, since TLS and HTTPS are standard for many benign and malicious activities. The exhibit's key evidence is the in-memory PowerShell execution from a document, not any data collection or exfiltration behavior.
- ✗
Worm activity, because the laptop communicated with an external IP address.
Why it's wrong here
Worm behavior is defined by self-propagation — replicating to other hosts, often via network shares, exploits, or removable media. Communication with an external IP address is an exceptionally generic indicator, present across many malware families and legitimate software updates. The exhibit shows only script execution on a single host, with no lateral movement, network scanning, or self-copying to other systems.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Fileless malware
Fileless malware is a type of malicious activity that uses legitimate system tools and memory to execute attacks, leaving no traditional file on the hard drive.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.