10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The C)PSH exam has 100 questions and runs 2 hours.
These 10 free C)PSH questions are organized by exam domain, so you can see how each part of the Certified Powershell Hacker blueprint is tested. Reveal the answer and explanation under each question.
A service-account audit on Windows PowerShell 5.1 uses this pipeline: Get-CimInstance -ClassName Win32_Service | Format-Table Name, StartName, State | Export-Csv -Path .\services.csv The CSV contains formatting metadata instead of usable service records. The reviewer needs one row per service and only the three named properties. Which edit repairs the data flow?
Correct answer: B - Replace Format-Table with Select-Object, retaining the same three properties.
This Windows PowerShell 5.1 collection step prints a path-not-found error and then prints COLLECTED: try { Get-Item -LiteralPath 'C:\Audit\missing.txt' -ErrorAction Continue 'COLLECTED' } catch { 'FAILED' } The file does not exist. The requirement is to enter catch when this read fails, without changing error handling for other commands. Select the appropriate local change.
Correct answer: A - Replace -ErrorAction Continue with -ErrorAction Stop on Get-Item.
Kerberos access to an HTTP service fails immediately after its process account changes from CORP\svcPortalOld to CORP\svcPortalNew. The service is configured to use its process account's Kerberos key. DNS resolves correctly, clocks are synchronized, and clients obtain fresh tickets for HTTP/portal.corp.example. That SPN remains registered only on svcPortalOld. The correction that addresses the mismatch is to:
Correct answer: D - Move the HTTP SPN to svcPortalNew; obtain a replacement service ticket.
During an authorized production assessment, a tester's validation requests coincide with a sharp rise in failed customer payments. The operations lead confirms that the payment service is degraded. The rules of engagement prohibit service disruption and provide an incident contact; the tester has no authority to change production configuration. What should the tester do immediately?
Correct answer: B - Stop the active test, preserve its timeline, and notify the designated incident contact.
A directory reviewer runs the following in Windows PowerShell 5.1 with the ActiveDirectory module: Get-ADUser -Identity svcInventory -Server dc01.corp.example | Select-Object Name, servicePrincipalName The SPN column is blank. A separate read of the same object on that domain controller confirms an SPN exists, and the reviewer has permission to read it. How should the query be corrected?
Correct answer: D - Add -Properties servicePrincipalName to Get-ADUser and retain the projection.
In an isolated-domain exercise, the team cannot recover a test account's long, randomly generated plaintext password. Nevertheless, it authenticates to an NTLM-enabled server using a usable NT hash obtained from the test endpoint; no Kerberos ticket is involved. Which description belongs in the assessment findings?
Correct answer: D - Pass-the-hash without first recovering the plaintext password.
Forensic analysis confirms that a ticket accepted by a SQL service was fabricated rather than copied from a legitimate session. Its protected service-ticket body used the key of CORP\svcSql, not a krbtgt key. What does this evidence identify?
Correct answer: C - A silver ticket: the forgery targets services associated with the compromised service identity.
An operator uses WinRM from ADMIN01 to MGMT01, then attempts a second WinRM connection from MGMT01 to APP01. Direct access from ADMIN01 to APP01 works, but the second hop fails. All three hosts use Windows PowerShell 5.1. Policy forbids forwarding the operator's reusable credentials to MGMT01. The inventory job may use a separate identity already authorized for the required read-only operations on APP01. Which design satisfies these constraints?
Correct answer: B - Use a restricted JEA endpoint on MGMT01 that runs the inventory task under the authorized separate identity.
After an account compromise, responders remove the affected user's privileged group memberships, reset its password, and rebuild the workstation. A directory review still finds a direct, effective WriteDACL allow entry for that user on a sensitive service-account object. No deny entry neutralizes it. Which residual capability makes the cleanup incomplete?
Correct answer: C - The user can rewrite the service account object's access permissions despite losing the groups.
An investigator has a process-creation record for powershell.exe on a Windows PowerShell 5.1 host. The initial command constructs additional code during execution, so its command line does not reveal the complete script. Script-block logging, module logging, process auditing, and Sysmon network logging were enabled before the incident. Which record is specifically intended to capture the script-block text processed by PowerShell?
Correct answer: A - Event 4104 in Microsoft-Windows-PowerShell/Operational.
The full bank has 1,020 more C)PSH questions with explanations.
Continue in the free practice test →
View plans