220-1202 Scripting Basics — 10 Questions

Question 1

A user reports that a VBScript logon script that maps network drives stopped working after a Windows update. The script uses the MapNetworkDrive method. Other scripts on the same computer work fine. What is the most likely cause?

Accepted Answer

The update disabled VBScript execution for security reasons.. Option C is correct because recent Windows updates have tightened security around legacy scripting hosts, including cscript.exe and wscript.exe. Specifically, Microsoft has introduced a default behavior that blocks VBScript execution via the Windows Script Host unless explicitly allowed by Group Policy or registry settings. Since the user reports that only the VBScript logon script fails while other scripts work, the most likely cause is that the update disabled VBScript execution, not that the script was deleted or that the script host was changed to PowerShell.

Answer

The script file was deleted by Windows Defender.

Answer

The update changed the default script host to PowerShell.

Answer

The network share requires SMB 2.0, which is no longer supported.

Question 2

A technician needs to deploy a script to 100 Windows 10 computers that will change the local administrator password. The script must run with elevated privileges and not leave the password visible in the script file. Which approach is most secure?

Accepted Answer

Use Group Policy Preferences to set the local administrator password.. Group Policy Preferences (GPP) allows administrators to configure local account passwords securely by encrypting the password in the policy XML file using a 32-byte AES key (though this key is publicly documented, it still provides obfuscation). When deployed via Group Policy, the password is applied with SYSTEM privileges automatically, eliminating the need for a script with embedded credentials or a separate scheduled task. This approach meets the requirements of elevated execution and password non-visibility in a script file.

Answer

Store the password in a plain text file and have the script read it.

Answer

Embed the password in the script using a variable and run it from a hidden share.

Answer

Use a scheduled task that runs the script as SYSTEM.

Question 3

A technician needs to deploy a configuration change to 50 Windows 10 computers using a script. The script must check if a specific registry key exists before modifying it. Which scripting construct should be used?

Accepted Answer

An if-else statement. The script needs to conditionally execute code based on whether a registry key exists. An if-else statement is the correct construct for this because it evaluates a condition (e.g., Test-Path 'HKLM:\Software\MyKey') and executes one block if true (modify the key) and another if false (skip or create). Loops are for repetition, not conditional branching, and try-catch handles runtime errors, not existence checks.

Answer

A for loop

Answer

A while loop

Answer

A try-catch block

Question 4

A technician is writing a PowerShell script to check the last boot time of a remote computer. The script uses Get-CimInstance Win32_OperatingSystem. The script works locally but fails with an access denied error when targeting a remote machine. Both computers are domain-joined and the technician has admin rights. What is the most likely issue?

Accepted Answer

The remote computer has Windows Firewall blocking WMI traffic.. Get-CimInstance uses the WS-Management (WSMan) protocol, which relies on WinRM. By default, Windows Firewall blocks inbound WinRM traffic on port 5985 (HTTP) and 5986 (HTTPS). Even though the technician has admin rights and both machines are domain-joined, the remote firewall must allow WinRM traffic for the CIM session to succeed. The local success is because no firewall traversal is needed.

Answer

The remote computer does not have PowerShell installed.

Answer

The script uses an incorrect namespace.

Answer

The technician is not a member of the Remote Management Users group.

Question 5

A technician needs to write a script that runs a specific command only if a Windows service is running. If the service is stopped, the script should start it first. Which scripting method is most appropriate?

Accepted Answer

Use an if-else statement to check the service status.. The correct answer is B because an if-else statement is the most appropriate scripting method to check the status of a specific Windows service and conditionally execute a command or start the service. In PowerShell, you can use `Get-Service` to retrieve the service status and then an if-else block to evaluate whether the `Status` property equals 'Running'. This provides clear, linear logic that directly matches the requirement without unnecessary complexity.

Answer

Use a for loop to iterate over all services.

Answer

Use a switch statement with multiple conditions.

Answer

Use a try-catch block to handle errors if the command fails.

Question 6

A user reports that a scheduled backup script on their Windows 10 workstation runs every day but fails to complete. The script uses PowerShell to copy files to a network share. When the user runs the script manually from an elevated PowerShell prompt, it works. What is the most likely cause of the failure?

Accepted Answer

The scheduled task is not set to run with highest privileges.. Scheduled tasks often run with limited permissions, so if the script requires administrative rights, it will fail when triggered automatically. The correct answer highlights the need to configure the task to run with highest privileges.

Answer

The script file extension is .ps1 instead of .bat.

Answer

The network share is mapped as a drive letter, which is not available during system startup.

Answer

PowerShell execution policy is set to Restricted for the SYSTEM account.

Question 7

A technician is troubleshooting a PowerShell script that collects system information and writes it to a log file. The script runs without errors but the log file is empty. The script uses Out-File to write data. What is the most likely issue?

Accepted Answer

The command before Out-File does not produce any output.. If a PowerShell command does not produce output, piping it to Out-File will result in an empty file. The issue is that the command used does not generate any output.

Answer

The script is not running with administrative privileges.

Answer

The Out-File cmdlet is misspelled.

Answer

The log file path contains a forward slash instead of a backslash.

Question 8

A user reports that a PowerShell script they wrote to rename multiple files in a folder works on their desktop but fails with a 'permission denied' error when run from a network folder. The user has full control of the network folder. What is the most likely cause?

Accepted Answer

The execution policy is set to RemoteSigned, which blocks scripts from network locations.. The PowerShell execution policy controls which scripts can run and from where. The RemoteSigned policy requires that scripts from the internet (including network shares) be digitally signed, and it treats network drives as an 'internet' zone. When the script is run from a network folder, the policy blocks execution unless the script is signed, resulting in a 'permission denied' error, even though the user has full NTFS permissions.

Answer

The script uses a cmdlet that is not available on the network drive.

Answer

The network folder has a space in its name.

Answer

The user is not running PowerShell as an administrator.

Question 9

A security incident occurs where an attacker used a PowerShell script to download and execute a payload from a remote server. The script was obfuscated and ran in memory without touching the disk. Which security control could have prevented this attack?

Accepted Answer

Enabling PowerShell Constrained Language Mode.. PowerShell Constrained Language Mode (CLM) restricts the language elements available to PowerShell, preventing the use of most .NET types, COM objects, and other advanced features that attackers rely on for in-memory payload execution. Since the attack used an obfuscated script that ran entirely in memory without touching disk, CLM would block the script's ability to invoke arbitrary .NET methods or Win32 API calls needed to download and execute the remote payload, stopping the attack before it could run.

Answer

Setting the execution policy to Restricted.

Answer

Disabling PowerShell script block logging.

Answer

Using a signed script policy.

Question 10

A technician writes a batch script to automate software installation across multiple workstations. The script needs to wait for the installer to finish before proceeding to the next line. Which command should be used?

Accepted Answer

START /WAIT. The START /WAIT command launches a specified program or script and pauses execution of the batch file until that process terminates. This is exactly what is needed to ensure the installer completes before the next line runs, making it the correct choice for sequential automation.

Answer

PAUSE

Answer

TIMEOUT

Answer

CALL