hardMultiple ChoiceObjective-mapped
PT0-002 Invoke-Command Practice Question
A penetration tester is analyzing a PowerShell script that uses the 'Invoke-Command' cmdlet to execute commands on remote machines, and 'Set-Service' to change service startup types. What attack is this script most likely performing?
⚠ Common exam trap
Test-takers frequently confuse the use of Invoke-Command (PowerShell Remoting) with PsExec, but PsExec is a distinct tool that does not use the Invoke-Command cmdlet, and the focus on service modification points to persistence rather than lateral movement or credential theft.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remote service modification for persistence.
The script uses Invoke-Command to execute commands on remote machines and Set-Service to change service startup types. This combination is commonly used to modify a service to start automatically or to create a new service that runs malicious code, establishing persistence on a remote system. The attack does not involve lateral movement via PsExec (which uses SMB and service control manager differently) nor credential dumping (which requires tools like Mimikatz or direct memory access).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Remote service modification for persistence.
Why this is correct
Invoke-Command with Set-Service is a classic persistence technique: it remotely alters a service's StartType (e.g., to Automatic) or recovery actions so that a malicious payload or backdoor survives reboots. The script does not show any new service creation, but modification of an existing service's configuration is sufficient for persistence because the service will launch automatically at system startup.
- ✗
Lateral movement via PsExec.
Why it's wrong here
PsExec lateral movement typically involves creating and starting a service on the remote host, often by copying a binary to the ADMIN$ share and executing it via the Service Control Manager. While Invoke-Command can be used for lateral movement, the described script only calls Set-Service to change configuration; it does not upload, create, or start a new service, so it is not executing code via PsExec.
- ✗
Credential dumping.
Why it's wrong here
Credential dumping techniques (e.g., Invoke-Mimikatz, accessing LSASS, or the SAM database) are completely absent from this script. Set-Service only interacts with the Service Control Manager; it does not read memory, access the registry hive, or invoke any credential-API calls. Therefore, the script's purpose is not credential theft.
- ✗
Data exfiltration.
Why it's wrong here
Data exfiltration requires moving data off the target (e.g., HTTP POST, SCP, DNS tunneling, or email). The script's use of Invoke-Command and Set-Service only alters service attributes; it does not read files, compress data, or initiate network transfers. Without any outbound connection or data-handling cmdlet, exfiltration is not supported.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
Key term
Mimikatz
Mimikatz is a powerful open-source tool used by attackers and security professionals to extract plaintext passwords, hashes, PINs, and Kerberos tickets from Windows memory.
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.