220-1202 Practice Test 50 — 15 Questions

Question 1

A technician is writing a PowerShell script to check the last boot time of a remote computer. The script uses Get-CimInstance Win32_OperatingSystem. The script works locally but fails with an access denied error when targeting a remote machine. Both computers are domain-joined and the technician has admin rights. What is the most likely issue?

Accepted Answer

The remote computer has Windows Firewall blocking WMI traffic.. Get-CimInstance uses the WS-Management (WSMan) protocol, which relies on WinRM. By default, Windows Firewall blocks inbound WinRM traffic on port 5985 (HTTP) and 5986 (HTTPS). Even though the technician has admin rights and both machines are domain-joined, the remote firewall must allow WinRM traffic for the CIM session to succeed. The local success is because no firewall traversal is needed.

Answer

The remote computer does not have PowerShell installed.

Answer

The script uses an incorrect namespace.

Answer

The technician is not a member of the Remote Management Users group.

Question 2

A technician is troubleshooting a slow Remote Desktop connection for a user working from home. The user's internet speed test shows 50 Mbps download and 10 Mbps upload. The office network has a 100 Mbps symmetrical connection. Which of the following is the most likely cause of the slowness?

Accepted Answer

The user's upload speed is insufficient for RDP. Remote Desktop Protocol (RDP) is highly sensitive to upload bandwidth because it transmits screen updates, keyboard/mouse input, and clipboard data from the client to the server. With only 10 Mbps upload at the user's home, the bottleneck is the user's upstream capacity, which is insufficient to handle the continuous screen refresh and input data required for a smooth RDP session, especially if the remote desktop is graphics-intensive or has high resolution.

Answer

The office network is oversubscribed

Answer

The user's internet connection has high latency

Answer

The VPN is using an outdated encryption protocol

Question 3

A technician needs to deploy a configuration change to 50 Windows 10 computers using a script. The script must check if a specific registry key exists before modifying it. Which scripting construct should be used?

Accepted Answer

An if-else statement. The script needs to conditionally execute code based on whether a registry key exists. An if-else statement is the correct construct for this because it evaluates a condition (e.g., Test-Path 'HKLM:\Software\MyKey') and executes one block if true (modify the key) and another if false (skip or create). Loops are for repetition, not conditional branching, and try-catch handles runtime errors, not existence checks.

Answer

A for loop

Answer

A while loop

Answer

A try-catch block

Question 4

A technician is tasked with securely connecting a remote office to the main office over the internet. The remote office has 10 users who need access to the same resources as local users. Which of the following remote access methods provides the most secure and scalable solution?

Accepted Answer

Set up a site-to-site VPN between the two offices. A site-to-site VPN (often using IPsec or a secure tunnel protocol) creates an encrypted, always-on connection between the two office routers, allowing all 10 users transparent access to the main office resources as if they were on the same LAN. This method is both secure (encrypting all traffic) and scalable (handling multiple users without per-client configuration), making it the best fit for connecting entire networks over the internet.

Answer

Configure port forwarding on the main office router for each required service

Answer

Use Remote Desktop for each user to connect to a workstation at the main office

Answer

Implement a client-to-site VPN for each user

Question 5

A user reports that a VBScript logon script that maps network drives stopped working after a Windows update. The script uses the MapNetworkDrive method. Other scripts on the same computer work fine. What is the most likely cause?

Accepted Answer

The update disabled VBScript execution for security reasons.. Option C is correct because recent Windows updates have tightened security around legacy scripting hosts, including cscript.exe and wscript.exe. Specifically, Microsoft has introduced a default behavior that blocks VBScript execution via the Windows Script Host unless explicitly allowed by Group Policy or registry settings. Since the user reports that only the VBScript logon script fails while other scripts work, the most likely cause is that the update disabled VBScript execution, not that the script was deleted or that the script host was changed to PowerShell.

Answer

The script file was deleted by Windows Defender.

Answer

The update changed the default script host to PowerShell.

Answer

The network share requires SMB 2.0, which is no longer supported.

Question 6

A security incident occurred where an attacker modified a PowerShell script on a file server to include malicious commands. The script is executed daily by a scheduled task. Which scripting security best practice could have prevented this attack?

Accepted Answer

Use a digital signature to sign the script and enforce execution policy. Option C is correct because enforcing an execution policy that requires scripts to be digitally signed ensures that only scripts signed by a trusted publisher can run. If the attacker modified the script, the digital signature would become invalid, and the execution policy would block the script from running, preventing the malicious commands from executing.

Answer

Store the script in a hidden folder

Answer

Set the script file to read-only

Answer

Compile the script into an executable

Question 7

A technician is writing a PowerShell script to retrieve the IP configuration of all computers in a domain and output the results to a CSV file. The script must run on a management workstation and target remote machines. Which cmdlet should the technician use to execute commands on remote computers?

Accepted Answer

Invoke-Command. Invoke-Command is the correct cmdlet because it is designed to execute PowerShell commands or script blocks on one or more remote computers and return the results to the local session. This allows the technician to run the IP configuration retrieval script against all domain computers from the management workstation and then pipe the output to Export-Csv.

Answer

Enter-PSSession

Answer

Get-WmiObject

Answer

Out-File

Question 8

A security incident occurs where an attacker used a PowerShell script to download and execute a payload from a remote server. The script was obfuscated and ran in memory without touching the disk. Which security control could have prevented this attack?

Accepted Answer

Enabling PowerShell Constrained Language Mode.. PowerShell Constrained Language Mode (CLM) restricts the language elements available to PowerShell, preventing the use of most .NET types, COM objects, and other advanced features that attackers rely on for in-memory payload execution. Since the attack used an obfuscated script that ran entirely in memory without touching disk, CLM would block the script's ability to invoke arbitrary .NET methods or Win32 API calls needed to download and execute the remote payload, stopping the attack before it could run.

Answer

Setting the execution policy to Restricted.

Answer

Disabling PowerShell script block logging.

Answer

Using a signed script policy.

Question 9

A technician needs to deploy a script to 100 Windows 10 computers that will change the local administrator password. The script must run with elevated privileges and not leave the password visible in the script file. Which approach is most secure?

Accepted Answer

Use Group Policy Preferences to set the local administrator password.. Group Policy Preferences (GPP) allows administrators to configure local account passwords securely by encrypting the password in the policy XML file using a 32-byte AES key (though this key is publicly documented, it still provides obfuscation). When deployed via Group Policy, the password is applied with SYSTEM privileges automatically, eliminating the need for a script with embedded credentials or a separate scheduled task. This approach meets the requirements of elevated execution and password non-visibility in a script file.

Answer

Store the password in a plain text file and have the script read it.

Answer

Embed the password in the script using a variable and run it from a hidden share.

Answer

Use a scheduled task that runs the script as SYSTEM.

Question 10

A help desk agent receives a call from a user who receives a 'file not found' error when running a PowerShell script that was working yesterday. The user says they didn't change anything. The script is stored on a network share. Which scripting concept is most likely causing the issue?

Accepted Answer

Execution policy. The most likely cause is the PowerShell execution policy, which controls whether scripts can run on a system. Even though the script worked yesterday, a Group Policy update, a system reboot, or a security change could have reset or tightened the execution policy to 'Restricted' or 'AllSigned' without the user's knowledge. Since the script is on a network share, the execution policy may also block scripts from remote locations (e.g., 'RemoteSigned' requires a trusted publisher for downloaded scripts), causing the 'file not found' error when PowerShell cannot execute the script due to policy restrictions.

Answer

File permissions

Answer

Script syntax error

Answer

Network connectivity

Question 11

A security incident occurs where an unauthorized PowerShell script was executed on a server, exfiltrating data. The IT manager wants to prevent any unsigned PowerShell scripts from running on all domain computers. Which scripting security measure should be implemented?

Accepted Answer

Set the execution policy to AllSigned. Option B is correct because setting the execution policy to AllSigned requires that all PowerShell scripts, including those written locally, be digitally signed by a trusted publisher before they can run. This directly addresses the requirement to prevent any unsigned PowerShell scripts from executing on domain computers, as it blocks both remote and local unsigned scripts.

Answer

Set the execution policy to Restricted

Answer

Set the execution policy to RemoteSigned

Answer

Disable PowerShell using Group Policy

Question 12

A technician is creating a PowerShell script that must be deployed via Group Policy to all workstations. The script should run in the user context and display a message if the user's password is about to expire within 7 days. The script must not show any PowerShell console window. Which scripting technique should be used?

Accepted Answer

Use a VBScript with a pop-up message box. Option B is correct because VBScript's `MsgBox` function creates a pop-up message box that runs in the user context without a console window, making it ideal for displaying password-expiry warnings via Group Policy. PowerShell scripts, even with `-WindowStyle Hidden`, briefly flash a console window unless compiled into an executable, which violates the requirement to show no console window. VBScript natively integrates with Windows Script Host (WSH) to produce a GUI pop-up without any console overhead.

Answer

Use the 'Write-Host' cmdlet to display the message

Answer

Use the '-NoProfile' parameter when starting PowerShell

Answer

Use a scheduled task with 'Run whether user is logged on or not'

Question 13

A technician is reviewing a PowerShell script that was used in a ransomware attack. The script contains a line that downloads and executes a payload from a remote server. The script uses a technique to bypass execution policy. Which scripting technique is most likely used to bypass the execution policy?

Accepted Answer

Using the '-ExecutionPolicy Bypass' parameter when launching PowerShell. The '-ExecutionPolicy Bypass' parameter when launching PowerShell tells the PowerShell engine to bypass the execution policy for that session only, allowing any script to run without restriction. This is a common technique used by attackers because it does not require administrative privileges or permanent policy changes, making it stealthy and effective for executing malicious payloads.

Answer

Using the 'Set-ExecutionPolicy' cmdlet to change the policy to Unrestricted

Answer

Using the 'powershell.exe -Command' syntax with an encoded command

Answer

Signing the script with a self-signed certificate

Question 14

A technician needs to deploy a PowerShell script to 50 Windows 10 workstations that will install a security update silently. The script must run with administrative privileges. Which method should the technician use to ensure the script executes properly without user interaction?

Accepted Answer

Run the script via 'powershell.exe -ExecutionPolicy Bypass -File script.ps1' from an elevated command prompt. Option B is correct because running 'powershell.exe -ExecutionPolicy Bypass -File script.ps1' from an elevated command prompt bypasses PowerShell's execution policy for that session and ensures the script runs with administrative privileges. This combination allows silent, unattended execution of the security update installation across multiple workstations without user interaction.

Answer

Double-click the script file on each workstation

Answer

Use the 'Start-Process' cmdlet without elevation

Answer

Copy the script to the Startup folder

Question 15

A company uses a login script that sets environment variables and maps drives based on the user's department. The script works for most users, but some report that the drive mappings are missing. The script is written in batch and uses 'if' statements to check department codes. What is the most likely cause of the intermittent failures?

Accepted Answer

The department codes in the script do not match the actual codes due to case sensitivity. Batch file 'if' statements are case-sensitive by default when comparing strings. If the script checks for department codes like 'SALES' but the actual environment variable or user input contains 'sales' or 'Sales', the comparison fails and the drive mapping block is skipped. This explains why the issue is intermittent — it depends on how the department code is stored or passed.

Answer

The script runs too early before the network is fully initialized

Answer

The script is using 'setx' instead of 'set' for environment variables

Answer

The user accounts lack permission to run login scripts