hardMultiple ChoiceObjective-mapped
220-1102 Practice Question: A technician is reviewing a PowerShell script…
A technician is reviewing a PowerShell script that was used in a ransomware attack. The script contains a line that downloads and executes a payload from a remote server. The script uses a technique to bypass execution policy. Which scripting technique is most likely used to bypass the execution policy?
⚠ Common exam trap
CompTIA often tests the distinction between permanently changing the execution policy (which requires admin rights and is detectable) versus using a session-level parameter to bypass it (which is stealthy and does not require admin rights), leading candidates to mistakenly choose the 'Set-ExecutionPolicy' option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using the '-ExecutionPolicy Bypass' parameter when launching PowerShell
The '-ExecutionPolicy Bypass' parameter when launching PowerShell tells the PowerShell engine to bypass the execution policy for that session only, allowing any script to run without restriction. This is a common technique used by attackers because it does not require administrative privileges or permanent policy changes, making it stealthy and effective for executing malicious payloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using the 'Set-ExecutionPolicy' cmdlet to change the policy to Unrestricted
Why it's wrong here
Using 'Set-ExecutionPolicy' to 'Unrestricted' is a direct modification of the system's execution policy, making it a persistent, system-wide change. This action typically requires administrative privileges, which an attacker may not possess or wish to obtain overtly to avoid detection. Furthermore, changing the system-wide policy leaves a clear, persistent trace in system logs and registry, making it easily detectable and not a stealthy approach for executing a single script.
- ✓
Using the '-ExecutionPolicy Bypass' parameter when launching PowerShell
Why this is correct
The '-ExecutionPolicy Bypass' parameter is a highly effective and stealthy method because it overrides the system's execution policy for the current PowerShell session only. This means the script can execute without requiring administrative privileges to alter system settings or leaving a permanent change on the system. It's a preferred technique for attackers as it allows immediate script execution without triggering system-wide security alerts or leaving persistent forensic artifacts.
- ✗
Using the 'powershell.exe -Command' syntax with an encoded command
Why it's wrong here
While 'powershell.exe -Command' with an encoded command can obfuscate the script's content, thereby bypassing some signature-based antivirus detection, it does not inherently bypass the PowerShell execution policy itself. The encoded command is merely a base64 representation of the script, which PowerShell decodes and then attempts to execute. The execution policy is applied to the *decoded* script, meaning if the policy is 'Restricted' or 'RemoteSigned' for an unsigned local script, it will still be blocked unless combined with a specific bypass parameter.
- ✗
Signing the script with a self-signed certificate
Why it's wrong here
Signing a script with a self-signed certificate is generally not a reliable method for bypassing execution policies like 'RemoteSigned' or 'AllSigned' in a hostile environment. For a signed script to execute, the system's execution policy must be set to 'AllSigned', and crucially, the certificate used for signing must be trusted by the system. Self-signed certificates are not inherently trusted by default and would require prior installation into the trusted root certificate store, which an attacker typically cannot achieve without elevated privileges.
Go deeper
Related to this question
Learn chapter
Windows Command Line Tools
Key term
PowerShell
PowerShell is a task automation and configuration management framework from Microsoft, consisting of a command-line shell and a scripting language built on the .NET framework.
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.