mediumMultiple ChoiceObjective-mapped
220-1202 Practice Question: A security incident occurs where an unauthorized…
A security incident occurs where an unauthorized PowerShell script was executed on a server, exfiltrating data. The IT manager wants to prevent any unsigned PowerShell scripts from running on all domain computers. Which scripting security measure should be implemented?
⚠ Common exam trap
A common mix-up: candidates confuse RemoteSigned with AllSigned, assuming that blocking internet-sourced scripts is sufficient, but they overlook that locally created unsigned scripts (e.g., written by an attacker after gaining access) remain a threat.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the execution policy to AllSigned
Setting the execution policy to AllSigned requires that all PowerShell scripts, including those written locally, be digitally signed by a trusted publisher before they can run. This directly addresses the requirement to prevent any unsigned PowerShell scripts from executing on domain computers, as it blocks both remote and local unsigned scripts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the execution policy to Restricted
Why it's wrong here
Setting the execution policy to `Restricted` completely prevents any PowerShell script from running, regardless of its origin or digital signature status. While this would block the unauthorized unsigned script, it simultaneously disables all legitimate administrative scripts and automation, severely impacting system functionality and manageability. This approach is overly restrictive and does not meet the implied requirement of allowing legitimate, signed scripts to execute.
- ✓
Set the execution policy to AllSigned
Why this is correct
The `AllSigned` execution policy mandates that all PowerShell scripts, whether created locally or downloaded from the internet, must be digitally signed by a trusted publisher before they can execute. This effectively blocks the unauthorized unsigned script, preventing its execution, while simultaneously permitting legitimate, signed administrative scripts to run. This policy strikes an optimal balance between security and operational functionality by ensuring script integrity and authenticity.
- ✗
Set the execution policy to RemoteSigned
Why it's wrong here
The `RemoteSigned` execution policy requires scripts downloaded from the internet to be digitally signed by a trusted publisher to run. However, it permits locally created scripts to execute without requiring a digital signature. Since the unauthorized PowerShell script could have been created or modified directly on the system, this policy would not reliably prevent its execution, failing to address the core security incident of an unauthorized script running.
- ✗
Disable PowerShell using Group Policy
Why it's wrong here
Completely disabling PowerShell via Group Policy would prevent all PowerShell operations, including legitimate administrative tasks, diagnostic tools, and automation scripts that rely on it. This drastic measure is not a targeted solution for managing script execution based on digital signatures or preventing specific unauthorized scripts. It would severely hinder system administration and is disproportionate to the requirement of blocking only unsigned scripts while allowing signed ones.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.