Memory Injection: The Fileless Exploit That Evades OS Detection

SY0-701 By islever Editorial Last updated

Explain various types of vulnerabilities.

Short answer

C Choose memory injection, because injected code executes within a legitimate process's memory and avoids the file-on-disk artifacts that OS-level file scanning relies on.

Question

Which of the following allows an exploit to go undetected by the operating system?
  1. Firmware vulnerabilities
  2. Side loading
  3. Memory injection Correct Answer
  4. Encrypted payloads

Key Takeaways

The question tests the difference between an in-memory execution technique and firmware-level persistence, with the trap being to choose firmware merely because it sits below the OS.

Memory injection is the SY0-701 concept that lets an exploit execute inside a legitimate process's memory without a file on disk, and this page establishes C as the answer.

Common mistake: The most plausible wrong answer is A, firmware vulnerabilities: firmware can hide activity from the OS, but the stem's undetected-exploit wording points to memory injection's fileless, in-process execution rather than a firmware vulnerability.

Expert Analysis

The decisive mechanism The stem asks for something that lets an exploit run without the operating system noticing it. In SY0-701 terms, the application-layer technique for this is memory injection: malicious code is placed into the address space of an already running, trusted process. The code executes from memory, so it does not need to create a suspicious executable on disk, and the activity can be blended with the legitimate process. That is why option C is the best fit.

Why firmware is the tempting distractor Option A, firmware vulnerabilities, also sits below the OS and can be very hard for OS-level tools to see. Learners often argue that firmware runs before or beneath the OS, so an exploit there is invisible. That is a real property, but the question is not asking about persistence across an OS reinstall or about pre-boot execution; it is asking what lets an exploit evade OS detection by executing in memory. A firmware vulnerability is a platform exposure; memory injection is the in-memory execution technique that matches the stem.

Eliminating the other options Option B, side loading, is about installing software from an unofficial source; it changes the trust path for an app but does not by itself hide an exploit from the OS. Option D, encrypted payloads, protects content in transit or at rest and may defeat inspection, but encryption alone does not make an exploit invisible to the operating system. The distinction is between transport or obfuscation and execution location.

Exam takeaway When the stem says fileless or in-memory, map it to memory injection. Use firmware vulnerabilities when the scenario stresses persistence in hardware, pre-boot control, or activity outside the OS's view. That objective-level distinction is what makes C correct here.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Treat words like undetected, fileless, and in-memory as pointers to the execution location. First eliminate options that describe software distribution (sideloading) or payload protection (encryption), because neither changes where code runs. Then compare the low-level candidates: memory injection places code inside a running process's address space, while firmware describes a platform exposure below the OS. CompTIA stems that emphasize persistence across an OS reinstall or pre-boot control lean toward firmware; stems that emphasize evading OS file scanning lean toward memory injection. Read the stem's consequence phrase carefully before choosing.

Frequently Asked Questions

Why is memory injection not simply detected as a running process?

The injected code runs inside a legitimate process, so process-name and file-path checks may see trusted software; behavior monitoring and EDR are needed to spot the anomalous memory operations.

When would firmware vulnerabilities be the better answer than memory injection?

When the scenario stresses pre-boot execution, persistence after an OS reinstall, or activity in device firmware below the OS, firmware is the intended layer; this stem stresses an exploit running undetected through memory.

Does an encrypted payload hide an exploit from the operating system?

No. Encryption can defeat network or content inspection, but once code executes on the endpoint the OS still handles the process and memory; encryption alone does not provide in-memory stealth.

More SY0-701 FAQ →

Discussion 16 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 16

  1. jbmac 👍 8 Answered C
    The correct answer is: C. Memory injection Explanation: Memory injection involves injecting malicious code or data into the memory of a running process or the operating system itself. This type of exploit allows the attacker to bypass traditional detection methods, as the malicious code is executed directly in memory and does not necessarily touch the file system. Since it is executed in memory, it can evade detection by antivirus software or other file-based security measures, allowing the exploit to go undetected by the operating system.
  2. drivinglama 👍 6
    I would disagree and stick to C. Memory injection, as while firmware vulnerabilities can be dangerous, they do not specifically allow exploits to go undetected by the operating system. They may affect the firmware level, which is below the OS and hence stay persistent despite OS reinstall, but detection by the OS is not always bypassed. Meanwhile memory injection is ephemeral and often is injected into running processes, hence avoiding potential detection by AV
  3. jacobtriestech 👍 6 Answered A
    Firmware vulnerabilities are often overlooked and can provide attackers with persistent access to a device, even after a full operating system reinstallation. This is because firmware is deeply embedded in the hardware and can be difficult to update or patch.
  4. gamer12213431234 👍 3 Answered A
    Firmware Vulnerabilities (A): Firmware executes at a privilege level below the operating system (such as Ring -1 or Ring -2 in UEFI/BIOS, or on peripheral device controllers). Because the operating system relies on the firmware to boot and interact with hardware, the OS itself has zero native visibility into what happens at the firmware layer. An exploit or rootkit living in the firmware operates entirely outside the OS's scope, making it fundamentally undetectable by the operating system.
  5. pindinga1 👍 3 Answered C
    The correct answer is C. Memory injection. Memory injection is a technique used by attackers to inject malicious code directly into the memory of a process, bypassing detection by the operating system's security mechanisms, such as antivirus or file integrity monitoring systems. The injected code can be executed within the process's address space, making it difficult for traditional file-based defenses to detect the exploit.
Show 11 more comments
  1. laternak26 👍 2 Answered A
    A. Firmware vulnerabilities: Firmware operates at a lower level than the operating system. It's the software embedded in hardware components like the BIOS/UEFI, network cards, hard drives, etc. If a vulnerability exists in the firmware, an exploit can run before the operating system even boots or can operate outside of the OS's control. NOT C. Memory injection: Memory injection involves inserting malicious code directly into a running process's memory. While this can be a powerful technique, the operating system's memory management and security features can potentially detect anomalies, especially if the injected code attempts unauthorized actions.
  2. Emmyrajj 👍 2 Answered C
    Memory injection is a technique where malicious code is injected directly into the memory space of a running process, allowing the exploit to execute without being written to disk. This makes it difficult for the operating system and traditional antivirus software to detect, as there are no files or persistent artifacts for security tools to analyze.
  3. 93bdd7c 👍 2 Answered C
    An exploit can go undetected by the operating system through several methods, but one of the most effective is memory injection. This technique involves injecting malicious code directly into the memory space of a running process, allowing the exploit to execute without being written to disk, thereby evading file-based detection systems.
  4. chasingsummer 👍 2 Answered C
    Memory injection involves injecting malicious code directly into the memory space of a running process, bypassing the operating system's file-based security checks.
  5. ProudFather 👍 1 Answered A
    Firmware vulnerabilities are often overlooked and can provide attackers with persistent access to a system, even after a full operating system reinstall. Firmware is the low-level software that controls hardware devices, and vulnerabilities in firmware can allow attackers to gain unauthorized access to a system and its data.
  6. BAM1 👍 1 Answered C
    C. Memory injection ✅ Memory injection (e.g., process injection) injects malicious code directly into the memory space of a legitimate process, allowing the exploit to run undetected by the OS or standard antivirus. This is commonly used in advanced malware and fileless attacks.
  7. TonyStarChillingFromHeaven 👍 1 Answered D
    While firmware vulnerabilities and memory injection are valid attack vectors, encrypted payloads specifically focus on evading detection by hiding the malicious content. This makes encrypted payloads the most appropriate answer for this question.
  8. Fourgehan 👍 1 Answered C
    Memory injection is the most direct technique that allows an exploit to go undetected by the operating system because it allows malicious code to run in the system's memory without leaving traces on disk, evading file-based detection systems
  9. tailogdavid1987 👍 1
    Firmware runs under the operating system, so the OS often cannot see the exploit. Memory injection still happens inside a process the OS can watch
  10. VoidDrive 👍 1 Answered D
    It's encrypted payloads. That's the point of the encryption. Used by "stealth" viruses and malware.
  11. 9ef4a35 👍 1
    The correct answer is A.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide