A public-health endpoint investigation finds malicious code executing primarily from memory after a user clicked a malicious link, with little lasting on disk. Which characteristic does that highlight?

Fileless or in-memory payload execution emphasizes malicious code that runs primarily from memory after initial delivery, leaving fewer durable on-disk artifacts for traditional file scanning. A public-health endpoint investigation that finds malicious code executing mainly from memory after a user clicked a malicious link, with little lasting on disk, highlights that characteristic: disk-clean triage is insufficient, and responders must consider process, memory, script host, and living-off-the-land telemetry. Clinic and public-health estates still need rapid isolation and memory-aware hunting even when file system scans look quiet.

Mandatory USB-only propagation across clinic kiosks fails because the stem describes post-click in-memory execution, not USB-forced spread as the defining trait. Authenticated Nessus scanning of vaccine-inventory servers fails because vulnerability scanning is an assessment activity, not the malware execution characteristic under investigation. Custom GPT assistants scoped to outbreak playbooks fail as an answer class; AI assistant scoping is unrelated to fileless/in-memory malware behavior on an endpoint.

Exam caveat: ‘fileless’ does not mean zero evidence—it means fewer classic file drops. Delivery may still begin with a link or document; the highlighted trait is where the payload runs afterward.

Operational check for public-health IR: isolate the endpoint, collect volatile memory and process listings per playbook, review browser/script-host child processes tied to the malicious link, hunt peers for the same in-memory patterns or parent-child trees, and rebuild or remediate with the understanding that wiping visible files alone may miss RAM-resident activity still present before reboot.