SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
EDR on a workstation shows winword.exe spawning powershell.exe with hidden, no-profile, and encoded arguments. No new executable is written to disk. Minutes later, a scheduled task creation is blocked, but the same host continues making HTTPS requests to a cloud IP address. Which malware category best fits this behavior?
⚠ Common exam trap
The trap here is that candidates see 'hidden commands' and 'network connections' and incorrectly associate them with a rootkit, but the 'hidden' refers to PowerShell's `-WindowStyle Hidden` parameter, not kernel-level hiding, and the network connections are standard HTTPS C2 traffic, not a rootkit's stealthy communication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fileless attack, because the payload is executed in memory using legitimate scripting tools and leaves little on disk.
The attack uses legitimate tools (winword.exe spawning powershell.exe) with hidden, no-profile, and encoded arguments to execute a payload entirely in memory, never writing a new executable to disk. This is the hallmark of a fileless attack, which relies on in-memory execution and living-off-the-land binaries (LOLBins) to evade traditional antivirus and disk-based detection. The subsequent scheduled task creation block and persistent HTTPS connections to a cloud IP further indicate a fileless malware that establishes command-and-control (C2) without dropping files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Trojan, because the malicious activity likely started from a user-opening event.
Why it's wrong here
Calling this a trojan conflates the initial delivery vector with the execution technique. A trojan is a standalone binary that masquerades as legitimate software, often requiring a user to open it, and typically drops a persistent file or installs itself. Here, the observable behavior is winword.exe spawning powershell.exe with encoded commands, which is a living-off-the-land, in-memory execution chain that leaves little on disk. Even if the attack began with a malicious document, the classification should reflect the fileless execution characteristics (no host payload dropped, script interpreted in memory), not the presumed user interaction.
- ✗
Worm, because the host is making repeated outbound network connections.
Why it's wrong here
Worms are self-replicating malware that spread autonomously across networks by exploiting services or copying themselves to remote hosts. Repeated outbound connections alone, such as HTTPS beaconing, indicate command-and-control communication or data exfiltration, not propagation. The scenario lacks evidence of network scanning, vulnerability exploitation, or lateral file transfer; it also shows a process executing entirely in memory via PowerShell, which is a fileless technique, not a worm's signature. Thus, qualifying this as a worm misreads network telemetry as proof of self-replication.
- ✗
Rootkit, because the process is using hidden commands and network connections.
Why it's wrong here
Rootkits specifically operate at the kernel or boot level, hooking system calls and hiding their own processes, files, or network activity from the operating system. In this detection, the EDR clearly observes winword.exe spawning powershell.exe and even flags outbound beaconing, meaning the malicious processes are not hidden—the commands are obfuscated but not stealthy at the OS level. Fileless malware, by contrast, avoids on-disk artifacts by executing in memory using legitimate tools; it does not attempt to subvert the kernel or conceal its existence from system APIs. Labeling this a rootkit incorrectly emphasizes obfuscation as kernel-level stealth, when the evidence points to an in-memory attack that is visible yet ephemeral.
- ✓
Fileless attack, because the payload is executed in memory using legitimate scripting tools and leaves little on disk.
Why this is correct
Fileless attack is the best fit because the sequence uses trusted built-in tools, encoded PowerShell, and no obvious executable drop on disk. The suspicious behavior happens in memory and through script interpretation, which makes detection harder than with traditional malware files. The blocked scheduled task and later HTTPS beaconing are consistent with in-memory execution and persistence attempts after initial delivery.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol Secure, or HTTPS, is the secure version of HTTP that encrypts data between a web browser and a website using SSL/TLS to protect sensitive information like passwords and credit card numbers.
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.