nerdexam
CompTIA

PT0-001 · Question #58

Consider the following PowerShell command: Cmdlet Which of the following BEST describes the actions performed by this command?

The correct answer is B. Execute a remote script. The PowerShell command shown uses functionality consistent with fetching and executing a script from a remote host, which classifies the action as executing a remote script.

Post-exploitation and lateral movement

Question

Consider the following PowerShell command:

Cmdlet Which of the following BEST describes the actions performed by this command?

Options

  • ASet the execution policy.
  • BExecute a remote script.
  • CRun an encoded command.
  • DInstantiate an object.

How the community answered

(61 responses)
  • A
    13% (8)
  • B
    79% (48)
  • C
    3% (2)
  • D
    5% (3)

Why each option

The PowerShell command shown uses functionality consistent with fetching and executing a script from a remote host, which classifies the action as executing a remote script.

ASet the execution policy.

Setting the execution policy uses the Set-ExecutionPolicy cmdlet to change the script permission level and does not involve downloading or running any remote content.

BExecute a remote script.Correct

PowerShell commands that combine Net.WebClient with DownloadString or use Invoke-WebRequest alongside Invoke-Expression (IEX) fetch and execute scripts hosted on remote systems entirely in memory. This technique is commonly used in post-exploitation to pull payloads without writing files to disk. The command performs network retrieval and in-memory execution of remotely hosted code rather than operating on local resources.

CRun an encoded command.

Running an encoded command uses the -EncodedCommand flag with a Base64-encoded string passed directly on the command line, which is a distinct technique from fetching and invoking a remote script.

DInstantiate an object.

Instantiating an object using New-Object creates a .NET object in memory but does not by itself perform the retrieval and execution of remotely hosted script content.

Concept tested: PowerShell remote script execution techniques

Source: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression

Topics

#PowerShell#remote script execution#Windows#post-exploitation

Community Discussion

No community discussion yet for this question.

Full PT0-001 Practice