PT0-001 · Question #58
Consider the following PowerShell command: Cmdlet Which of the following BEST describes the actions performed by this command?
The correct answer is B. Execute a remote script. The PowerShell command shown uses functionality consistent with fetching and executing a script from a remote host, which classifies the action as executing a remote script.
Question
Consider the following PowerShell command:
Cmdlet Which of the following BEST describes the actions performed by this command?
Options
- ASet the execution policy.
- BExecute a remote script.
- CRun an encoded command.
- DInstantiate an object.
How the community answered
(61 responses)- A13% (8)
- B79% (48)
- C3% (2)
- D5% (3)
Why each option
The PowerShell command shown uses functionality consistent with fetching and executing a script from a remote host, which classifies the action as executing a remote script.
Setting the execution policy uses the Set-ExecutionPolicy cmdlet to change the script permission level and does not involve downloading or running any remote content.
PowerShell commands that combine Net.WebClient with DownloadString or use Invoke-WebRequest alongside Invoke-Expression (IEX) fetch and execute scripts hosted on remote systems entirely in memory. This technique is commonly used in post-exploitation to pull payloads without writing files to disk. The command performs network retrieval and in-memory execution of remotely hosted code rather than operating on local resources.
Running an encoded command uses the -EncodedCommand flag with a Base64-encoded string passed directly on the command line, which is a distinct technique from fetching and invoking a remote script.
Instantiating an object using New-Object creates a .NET object in memory but does not by itself perform the retrieval and execution of remotely hosted script content.
Concept tested: PowerShell remote script execution techniques
Source: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression
Topics
Community Discussion
No community discussion yet for this question.