The answer is to use Group Policy Preferences to set the local administrator password. This approach is the most secure because Group Policy Preferences encrypts the password within the policy’s XML file using a 32-byte AES key, providing obfuscation even though the key is publicly documented. When deployed, the password is applied with SYSTEM privileges automatically, meeting the requirement for elevated execution without leaving the password visible in a script file. On the CompTIA A+ Core 2 220-1202 exam, this question tests your understanding of secure local admin password deployment via Group Policy, often contrasting it with less secure methods like embedding credentials in a batch script or using an unencrypted scheduled task. A common trap is assuming a script is needed, but GPP handles both elevation and obfuscation natively. Memory tip: think “GPP encrypts, script decrypts”—the policy does the heavy lifting so you don’t have to.
220-1202 Scripting Basics Practice Question
This 220-1202 practice question tests your understanding of scripting basics. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A technician needs to deploy a script to 100 Windows 10 computers that will change the local administrator password. The script must run with elevated privileges and not leave the password visible in the script file. Which approach is most secure?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Group Policy Preferences to set the local administrator password.
Group Policy Preferences (GPP) allows administrators to configure local account passwords securely by encrypting the password in the policy XML file using a 32-byte AES key (though this key is publicly documented, it still provides obfuscation). When deployed via Group Policy, the password is applied with SYSTEM privileges automatically, eliminating the need for a script with embedded credentials or a separate scheduled task. This approach meets the requirements of elevated execution and password non-visibility in a script file.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Store the password in a plain text file and have the script read it.
Why it's wrong here
Plain text passwords are easily compromised; this is not secure.
✓
Use Group Policy Preferences to set the local administrator password.
Why this is correct
Group Policy Preferences can set the password securely with encryption and no script exposure.
Related concept
Read the scenario before looking for a memorised answer.
✗
Embed the password in the script using a variable and run it from a hidden share.
Why it's wrong here
Hidden shares still expose the script to anyone who can access the share; the password is visible in the script.
✗
Use a scheduled task that runs the script as SYSTEM.
Why it's wrong here
Running as SYSTEM does not hide the password; it is still visible in the script file.
Common exam traps
Common exam trap: answer the scenario, not the keyword
CompTIA often tests the misconception that embedding a password in a script variable or using SYSTEM-level execution is sufficient for security, when in fact the password remains visible in the script file itself, which is the core vulnerability being assessed.
Detailed technical explanation
How to think about this question
Group Policy Preferences stores the encrypted password in the SYSVOL folder under a GPO's XML file, using a 32-byte AES key derived from a Microsoft-published static key (which is publicly known, making it reversible but still requiring administrative access to the SYSVOL). In real-world scenarios, Microsoft deprecated GPP password encryption in 2014 due to the static key exposure, recommending instead to use Group Policy Local Users and Groups with a 'Configure' action or a more secure solution like LAPS (Local Administrator Password Solution) for unique, rotated passwords per machine.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 220-1202 question in full detail.
Scripting Basics — This question tests Scripting Basics — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use Group Policy Preferences to set the local administrator password. — Group Policy Preferences (GPP) allows administrators to configure local account passwords securely by encrypting the password in the policy XML file using a 32-byte AES key (though this key is publicly documented, it still provides obfuscation). When deployed via Group Policy, the password is applied with SYSTEM privileges automatically, eliminating the need for a script with embedded credentials or a separate scheduled task. This approach meets the requirements of elevated execution and password non-visibility in a script file.
What should I do if I get this 220-1202 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.