SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
During triage, you see a legitimate browser process spawning powershell.exe with an encoded command, followed by an outbound connection to a newly registered domain. No new executable is written to disk. Which malware characteristic best fits this behavior?
⚠ Common exam trap
Many candidates assume any malware that doesn't write a file is a 'macro virus' or 'boot sector virus,' but the key differentiator is the use of a scripting engine (PowerShell) spawned by a legitimate process, combined with memory-only execution and an immediate C2 connection, which uniquely defines fileless malware.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fileless malware that relies on scripting and memory-resident execution.
The described behavior—a legitimate browser process spawning PowerShell with an encoded command, executing in memory without writing a new executable to disk, and making an outbound connection to a newly registered domain—is the classic hallmark of fileless malware. Fileless malware leverages built-in scripting engines (like PowerShell) and runs entirely in memory, avoiding traditional disk-based detection by antivirus and forensic tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Fileless malware that relies on scripting and memory-resident execution.
Why this is correct
This pattern matches malware that abuses trusted processes and scripts instead of dropping a traditional executable file. Browser-to-PowerShell chaining, encoded commands, and memory-resident activity are common indicators. The lack of a new file on disk does not mean the endpoint is clean; it often means the attacker is trying to evade traditional file-based detection.
- ✗
A macro virus that only runs when a document is opened.
Why it's wrong here
A macro virus is embedded in Office documents and only executes after a user opens the file and enables content, usually via a social-engineering prompt. This scenario's observed chain begins with a legitimate browser process spawning child processes, not with a document-opening action. Furthermore, macro viruses typically drop a binary payload to disk or run VBA directly, whereas the browser-to-PowerShell pattern with encoded commands is a hallmark of fileless malware operating entirely in memory.
- ✗
A boot sector virus that persists by altering startup code.
Why it's wrong here
A boot sector virus resides in the master boot record or volume boot record and runs during the pre-OS boot phase, modifying startup code to persist and gain control on every reboot. This type of infection is installed via physical media or low-level writes, not via browser-initiated scripts or outbound web connections, and it would not cause an immediate browser-to-PowerShell process chain during triage. The absence of disk-level persistence and the presence of memory-resident scripting indicate an active runtime exploit, not a boot-time infection.
- ✗
A logic bomb that activates only when a specific date or event is reached.
Why it's wrong here
A logic bomb is malicious code that remains dormant until a specific condition is met, such as a date, time, or event (e.g., a user accessing a particular file). The activity observed during triage is already actively occurring, with a browser process spawning child processes, so the malware is not waiting for a trigger. Logic bombs are typically hidden inside legitimate applications or scripts and are not associated with the immediate, interactive execution pattern seen here. The memory-resident, script-based execution is consistent with fileless malware that runs its payload as soon as it is delivered.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Fileless malware
Fileless malware is a type of malicious activity that uses legitimate system tools and memory to execute attacks, leaving no traditional file on the hard drive.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.