hardMultiple ChoiceObjective-mapped
220-1102 Practice Question: Deploy a script to 100 Windows 10 computers that…
A technician needs to deploy a script to 100 Windows 10 computers that will change the local administrator password. The script must run with elevated privileges and not leave the password visible in the script file. Which approach is most secure?
⚠ Common exam trap
CompTIA often tests the misconception that embedding a password in a script variable or using SYSTEM-level execution is sufficient for security, when in fact the password remains visible in the script file itself, which is the core vulnerability being assessed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Group Policy Preferences to set the local administrator password.
Group Policy Preferences (GPP) allows administrators to configure local account passwords securely by encrypting the password in the policy XML file using a 32-byte AES key (though this key is publicly documented, it still provides obfuscation). When deployed via Group Policy, the password is applied with SYSTEM privileges automatically, eliminating the need for a script with embedded credentials or a separate scheduled task. This approach meets the requirements of elevated execution and password non-visibility in a script file.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the password in a plain text file and have the script read it.
Why it's wrong here
Storing a password in a plain text file is a severe security vulnerability. Any user or process with read access to the file system location where the password file resides can easily view the credentials without any decryption. This method completely bypasses secure credential management practices and poses a significant risk of unauthorized access to the target systems.
- ✓
Use Group Policy Preferences to set the local administrator password.
Why this is correct
Group Policy Preferences (GPP) provides a secure and scalable method for setting local administrator passwords across multiple machines. When configured, GPP encrypts the password using AES-256 within the Group Policy Object (GPO) itself. The client-side extension then decrypts and applies the password locally, preventing its exposure in plain text during transmission or storage on the client, thus centralizing and securing the deployment.
- ✗
Embed the password in the script using a variable and run it from a hidden share.
Why it's wrong here
Embedding a password directly within a script, even when run from a hidden share, does not provide adequate security. A hidden share (e.g., \\server\share$) only prevents casual browsing; it does not restrict access for users who know the path or have appropriate permissions. The script file itself, containing the password in plain sight within a variable, remains a major vulnerability once accessed, allowing the credential to be easily compromised.
- ✗
Use a scheduled task that runs the script as SYSTEM.
Why it's wrong here
Running a script as the SYSTEM account grants it maximum local privileges to execute commands on the machine. However, this elevated execution context does not secure the *contents* of the script itself. The password, if embedded directly within the script file, remains visible in plain text to anyone with read access to that script, regardless of the account used for execution, leaving the credential exposed.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Windows Editions and Features
Key term
Windows
Windows is a family of operating systems developed by Microsoft that manages computer hardware and software, providing a graphical user interface for users to interact with their devices.
Key term
Windows 10
Windows 10 is a personal computer operating system developed by Microsoft that combines the familiarity of Windows 7 with the modern features of Windows 8, designed to run on a wide range of devices from desktops to tablets.
About these practice questions
One of 495 original 220-1202 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.