220-1202 Scripting Basics — Timed 20 Questions

Question 1

A user reports that a VBScript logon script that maps network drives stopped working after a Windows update. The script uses the MapNetworkDrive method. Other scripts on the same computer work fine. What is the most likely cause?

Accepted Answer

The update disabled VBScript execution for security reasons.. Option C is correct because recent Windows updates have tightened security around legacy scripting hosts, including cscript.exe and wscript.exe. Specifically, Microsoft has introduced a default behavior that blocks VBScript execution via the Windows Script Host unless explicitly allowed by Group Policy or registry settings. Since the user reports that only the VBScript logon script fails while other scripts work, the most likely cause is that the update disabled VBScript execution, not that the script was deleted or that the script host was changed to PowerShell.

Answer

The script file was deleted by Windows Defender.

Answer

The update changed the default script host to PowerShell.

Answer

The network share requires SMB 2.0, which is no longer supported.

Question 2

A technician needs to deploy a script to 100 Windows 10 computers that will change the local administrator password. The script must run with elevated privileges and not leave the password visible in the script file. Which approach is most secure?

Accepted Answer

Use Group Policy Preferences to set the local administrator password.. Group Policy Preferences (GPP) allows administrators to configure local account passwords securely by encrypting the password in the policy XML file using a 32-byte AES key (though this key is publicly documented, it still provides obfuscation). When deployed via Group Policy, the password is applied with SYSTEM privileges automatically, eliminating the need for a script with embedded credentials or a separate scheduled task. This approach meets the requirements of elevated execution and password non-visibility in a script file.

Answer

Store the password in a plain text file and have the script read it.

Answer

Embed the password in the script using a variable and run it from a hidden share.

Answer

Use a scheduled task that runs the script as SYSTEM.

Question 3

A technician needs to deploy a configuration change to 50 Windows 10 computers using a script. The script must check if a specific registry key exists before modifying it. Which scripting construct should be used?

Accepted Answer

An if-else statement. The script needs to conditionally execute code based on whether a registry key exists. An if-else statement is the correct construct for this because it evaluates a condition (e.g., Test-Path 'HKLM:\Software\MyKey') and executes one block if true (modify the key) and another if false (skip or create). Loops are for repetition, not conditional branching, and try-catch handles runtime errors, not existence checks.

Answer

A for loop

Answer

A while loop

Answer

A try-catch block

Question 4

A technician is writing a PowerShell script to check the last boot time of a remote computer. The script uses Get-CimInstance Win32_OperatingSystem. The script works locally but fails with an access denied error when targeting a remote machine. Both computers are domain-joined and the technician has admin rights. What is the most likely issue?

Accepted Answer

The remote computer has Windows Firewall blocking WMI traffic.. Get-CimInstance uses the WS-Management (WSMan) protocol, which relies on WinRM. By default, Windows Firewall blocks inbound WinRM traffic on port 5985 (HTTP) and 5986 (HTTPS). Even though the technician has admin rights and both machines are domain-joined, the remote firewall must allow WinRM traffic for the CIM session to succeed. The local success is because no firewall traversal is needed.

Answer

The remote computer does not have PowerShell installed.

Answer

The script uses an incorrect namespace.

Answer

The technician is not a member of the Remote Management Users group.

Question 5

A technician needs to write a script that runs a specific command only if a Windows service is running. If the service is stopped, the script should start it first. Which scripting method is most appropriate?

Accepted Answer

Use an if-else statement to check the service status.. The correct answer is B because an if-else statement is the most appropriate scripting method to check the status of a specific Windows service and conditionally execute a command or start the service. In PowerShell, you can use `Get-Service` to retrieve the service status and then an if-else block to evaluate whether the `Status` property equals 'Running'. This provides clear, linear logic that directly matches the requirement without unnecessary complexity.

Answer

Use a for loop to iterate over all services.

Answer

Use a switch statement with multiple conditions.

Answer

Use a try-catch block to handle errors if the command fails.

Question 6

A user reports that a scheduled backup script on their Windows 10 workstation runs every day but fails to complete. The script uses PowerShell to copy files to a network share. When the user runs the script manually from an elevated PowerShell prompt, it works. What is the most likely cause of the failure?

Accepted Answer

The scheduled task is not set to run with highest privileges.. Scheduled tasks often run with limited permissions, so if the script requires administrative rights, it will fail when triggered automatically. The correct answer highlights the need to configure the task to run with highest privileges.

Answer

The script file extension is .ps1 instead of .bat.

Answer

The network share is mapped as a drive letter, which is not available during system startup.

Answer

PowerShell execution policy is set to Restricted for the SYSTEM account.

Question 7

A technician is troubleshooting a PowerShell script that collects system information and writes it to a log file. The script runs without errors but the log file is empty. The script uses Out-File to write data. What is the most likely issue?

Accepted Answer

The command before Out-File does not produce any output.. If a PowerShell command does not produce output, piping it to Out-File will result in an empty file. The issue is that the command used does not generate any output.

Answer

The script is not running with administrative privileges.

Answer

The Out-File cmdlet is misspelled.

Answer

The log file path contains a forward slash instead of a backslash.

Question 8

A user reports that a PowerShell script they wrote to rename multiple files in a folder works on their desktop but fails with a 'permission denied' error when run from a network folder. The user has full control of the network folder. What is the most likely cause?

Accepted Answer

The execution policy is set to RemoteSigned, which blocks scripts from network locations.. The PowerShell execution policy controls which scripts can run and from where. The RemoteSigned policy requires that scripts from the internet (including network shares) be digitally signed, and it treats network drives as an 'internet' zone. When the script is run from a network folder, the policy blocks execution unless the script is signed, resulting in a 'permission denied' error, even though the user has full NTFS permissions.

Answer

The script uses a cmdlet that is not available on the network drive.

Answer

The network folder has a space in its name.

Answer

The user is not running PowerShell as an administrator.

Question 9

A security incident occurs where an attacker used a PowerShell script to download and execute a payload from a remote server. The script was obfuscated and ran in memory without touching the disk. Which security control could have prevented this attack?

Accepted Answer

Enabling PowerShell Constrained Language Mode.. PowerShell Constrained Language Mode (CLM) restricts the language elements available to PowerShell, preventing the use of most .NET types, COM objects, and other advanced features that attackers rely on for in-memory payload execution. Since the attack used an obfuscated script that ran entirely in memory without touching disk, CLM would block the script's ability to invoke arbitrary .NET methods or Win32 API calls needed to download and execute the remote payload, stopping the attack before it could run.

Answer

Setting the execution policy to Restricted.

Answer

Disabling PowerShell script block logging.

Answer

Using a signed script policy.

Question 10

A technician writes a batch script to automate software installation across multiple workstations. The script needs to wait for the installer to finish before proceeding to the next line. Which command should be used?

Accepted Answer

START /WAIT. The START /WAIT command launches a specified program or script and pauses execution of the batch file until that process terminates. This is exactly what is needed to ensure the installer completes before the next line runs, making it the correct choice for sequential automation.

Answer

PAUSE

Answer

TIMEOUT

Answer

CALL

Question 11

A technician is reviewing a PowerShell script that was used in a ransomware attack. The script contains a line that downloads and executes a payload from a remote server. The script uses a technique to bypass execution policy. Which scripting technique is most likely used to bypass the execution policy?

Accepted Answer

Using the '-ExecutionPolicy Bypass' parameter when launching PowerShell. The '-ExecutionPolicy Bypass' parameter when launching PowerShell tells the PowerShell engine to bypass the execution policy for that session only, allowing any script to run without restriction. This is a common technique used by attackers because it does not require administrative privileges or permanent policy changes, making it stealthy and effective for executing malicious payloads.

Answer

Using the 'Set-ExecutionPolicy' cmdlet to change the policy to Unrestricted

Answer

Using the 'powershell.exe -Command' syntax with an encoded command

Answer

Signing the script with a self-signed certificate

Question 12

A security incident occurs where an unauthorized PowerShell script was executed on a server, exfiltrating data. The IT manager wants to prevent any unsigned PowerShell scripts from running on all domain computers. Which scripting security measure should be implemented?

Accepted Answer

Set the execution policy to AllSigned. Option B is correct because setting the execution policy to AllSigned requires that all PowerShell scripts, including those written locally, be digitally signed by a trusted publisher before they can run. This directly addresses the requirement to prevent any unsigned PowerShell scripts from executing on domain computers, as it blocks both remote and local unsigned scripts.

Answer

Set the execution policy to Restricted

Answer

Set the execution policy to RemoteSigned

Answer

Disable PowerShell using Group Policy

Question 13

A technician is troubleshooting a batch script that is supposed to delete temporary files older than 30 days. The script runs without errors but does not delete any files. The technician suspects the script's logic is flawed. Which part of the script is most likely incorrect?

Accepted Answer

The script uses 'forfiles' with the wrong date syntax. This tests understanding of file management commands and conditionals in batch scripting. The FORFILES command with date filtering is commonly used for this. If the script uses a simple 'del' without date checking, it will delete all files or none. The issue is likely that the script does not properly compare file dates.

Answer

The script uses the 'del' command without a path

Answer

The script runs as a standard user without admin rights

Answer

The script uses 'echo' instead of 'del'

Question 14

A user reports that a scheduled task running a VBScript fails every time the computer is rebooted. The script works when run manually. The technician checks the task properties and sees the task is set to run with the user's credentials. Which scripting-related issue is most likely causing the failure?

Accepted Answer

The task is set to run only when the user is logged on. This tests understanding of script execution context and permissions. When a script runs under a user account, it may not have the necessary permissions to access network resources or system files after reboot if the user isn't logged on. The 'run whether user is logged on or not' option requires the password to be stored, and if the password changes or is not provided, the task fails.

Answer

The script has a syntax error

Answer

The script uses absolute paths that change after reboot

Answer

The script is blocked by antivirus software

Question 15

A technician is writing a PowerShell script to retrieve the IP configuration of all computers in a domain and output the results to a CSV file. The script must run on a management workstation and target remote machines. Which cmdlet should the technician use to execute commands on remote computers?

Accepted Answer

Invoke-Command. Invoke-Command is the correct cmdlet because it is designed to execute PowerShell commands or script blocks on one or more remote computers and return the results to the local session. This allows the technician to run the IP configuration retrieval script against all domain computers from the management workstation and then pipe the output to Export-Csv.

Answer

Enter-PSSession

Answer

Get-WmiObject

Answer

Out-File

Question 16

A technician is creating a PowerShell script that must be deployed via Group Policy to all workstations. The script should run in the user context and display a message if the user's password is about to expire within 7 days. The script must not show any PowerShell console window. Which scripting technique should be used?

Accepted Answer

Use a VBScript with a pop-up message box. Option B is correct because VBScript's `MsgBox` function creates a pop-up message box that runs in the user context without a console window, making it ideal for displaying password-expiry warnings via Group Policy. PowerShell scripts, even with `-WindowStyle Hidden`, briefly flash a console window unless compiled into an executable, which violates the requirement to show no console window. VBScript natively integrates with Windows Script Host (WSH) to produce a GUI pop-up without any console overhead.

Answer

Use the 'Write-Host' cmdlet to display the message

Answer

Use the '-NoProfile' parameter when starting PowerShell

Answer

Use a scheduled task with 'Run whether user is logged on or not'

Question 17

A help desk agent receives a call from a user who receives a 'file not found' error when running a PowerShell script that was working yesterday. The user says they didn't change anything. The script is stored on a network share. Which scripting concept is most likely causing the issue?

Accepted Answer

Execution policy. The most likely cause is the PowerShell execution policy, which controls whether scripts can run on a system. Even though the script worked yesterday, a Group Policy update, a system reboot, or a security change could have reset or tightened the execution policy to 'Restricted' or 'AllSigned' without the user's knowledge. Since the script is on a network share, the execution policy may also block scripts from remote locations (e.g., 'RemoteSigned' requires a trusted publisher for downloaded scripts), causing the 'file not found' error when PowerShell cannot execute the script due to policy restrictions.

Answer

File permissions

Answer

Script syntax error

Answer

Network connectivity

Question 18

A technician is writing a Python script to automate the cleanup of user profiles on a Windows server. The script must iterate through all user profile folders in 'C:\Users', check the last modified date, and delete profiles older than 90 days. Which scripting concept is essential for this task?

Accepted Answer

A for loop to iterate over folders. This question tests understanding of loops, conditionals, and file system operations in a scripting language. A 'for' loop is needed to iterate through each folder, combined with an 'if' statement to check the date condition. Without a loop, the script would only process one folder. Error handling is important but not the core concept for iteration.

Answer

Error handling with try-except

Answer

A while loop with a counter

Answer

A function to calculate date difference

Question 19

A technician is writing a batch script to automate the installation of a software package on multiple Windows workstations. The script needs to check if the software is already installed before attempting installation. Which scripting construct should the technician use?

Accepted Answer

An if statement. This tests knowledge of conditional logic in scripting. An 'if' statement allows the script to check a condition (e.g., existence of a registry key or file) and execute code only if the condition is true or false. Loops are for repetition, and variables store data, not control flow.

Answer

A for loop

Answer

A variable

Answer

A while loop

Question 20

A system administrator is deploying a PowerShell script to 100 computers to change the local administrator password. The script must run once per computer and then exit. Which scripting technique ensures the script runs exactly once on each machine?

Accepted Answer

Write a registry key after successful execution. This question covers idempotency and run-once mechanisms. Using a registry key or a marker file to record that the script has executed prevents it from running again on reboot or reapplication. Loops and parameters don't enforce a single execution.

Answer

Use a for loop to run the script 100 times

Answer

Use a parameter to pass the computer name

Answer

Schedule the script to run daily