MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. PowerShell script execution attacks often exploit which interpreter-based feature?
   a. Command and Scripting Interpreter
   b. Windows Defender APIs
   c. SQL Injection Handler
   d. File Allocation Table
   Answer: aattack.mitre​
2. The MITRE ATT&CK code for PowerShell-based execution is identified as:
   a. T1059.001
   b. T1055.008
   c. T1566.002
   d. T1012.004
   Answer: aattack.mitre​
3. Attackers often use PowerShell to:
   a. Automate defense tasks
   b. Execute payloads and evade detection
   c. Increase CPU usage for testing
   d. Encrypt disks for legitimate users
   Answer: bredcanary​
4. The “Invoke-Expression” cmdlet is commonly abused in PowerShell attacks because it:
   a. Speeds up task scheduling
   b. Runs arbitrary strings as commands
   c. Restricts command execution
   d. Checks system memory
   Answer: blearn.microsoft​
5. A major reason attackers prefer PowerShell is that it is:
   a. Not monitored by antivirus
   b. Built into modern Windows systems
   c. Only usable via network APIs
   d. A Linux-exclusive tool
   Answer: bredcanary​
6. The “-encodedcommand” option in PowerShell is often used for:
   a. Remote firewall configuration
   b. Encoding malicious scripts to evade detection
   c. Script formatting for admins
   d. Automatic patch installation
   Answer: bblackfog​
7. PowerShell attacks that run commands directly in memory without touching disk are called:
   a. Fileless attacks
   b. Dropper-based attacks
   c. Coded injections
   d. Drive-by attacks
   Answer: acybereason​
8. Which cmdlet allows viewing PowerShell’s script execution policy?
   a. Get-ExecutionPolicy
   b. Set-SecurityPolicy
   c. View-ScriptExecution
   d. Get-PolicyLevel
   Answer: acodecademy​
9. The default PowerShell execution policy that blocks scripts is called:
   a. Restricted
   b. RemoteSigned
   c. Unrestricted
   d. AllSigned
   Answer: acodecademy​
10. A common method used by attackers to run PowerShell remotely is:
    a. Remote script download using “iex(New-Object Net.WebClient)”
    b. Using the netsh firewall utility
    c. Registry edits via regedit
    d. PowerBI dashboard automation
    Answer: ablackfog​
11. The tactic under which PowerShell script execution falls in MITRE ATT&CK is:
    a. Execution
    b. Discovery
    c. Persistence
    d. Privilege Escalation
    Answer: aelastic​
12. PowerShell obfuscation is used to:
    a. Improve read performance
    b. Hide malicious commands
    c. Format logs
    d. Encrypt backups
    Answer: bblackfog​
13. The default PowerShell policy that allows only signed scripts is:
    a. AllSigned
    b. Restricted
    c. RemoteSigned
    d. SecureMode
    Answer: acodecademy​
14. PowerShell script injection can occur when:
    a. User input is not sanitized
    b. Functions contain too many parameters
    c. Disk usage exceeds 90%
    d. Internet connection fails
    Answer: alearn.microsoft​
15. PowerShell attacks often use Base64 encoding because it:
    a. Enhances speed
    b. Masks script content
    c. Reduces size drastically
    d. Enables multithreading
    Answer: bblackfog​
16. A PowerShell execution policy to allow local scripts but require signatures for remote ones is:
    a. RemoteSigned
    b. Unrestricted
    c. SignedOnly
    d. Restricted
    Answer: acodecademy​
17. Adversaries abuse PowerShell because it provides:
    a. Access to the .NET framework
    b. GPU acceleration
    c. Fast log deletion
    d. Automatic privilege reduction
    Answer: aredcanary​
18. One way defenders can detect PowerShell abuse is by monitoring:
    a. Get-WmiObject executions
    b. Disk fragmentation levels
    c. RAM empty space
    d. Windows Help requests
    Answer: apicussecurity​
19. Penetration testers use PowerShell for:
    a. Automated reconnaissance and exploitation
    b. Manual data entry
    c. BIOS flashing
    d. Simple note-taking tasks
    Answer: aeccouncil​
20. PowerShell’s inclusion in modern Windows systems makes it a:
    a. Built-in automation and scripting tool
    b. Web-only API
    c. Deprecated legacy feature
    d. Linux package
    Answer: aredcanary​
21. Attackers commonly execute encoded PowerShell commands for:
    a. Payload delivery
    b. TCP optimization
    c. Disk cleanup
    d. Encryption key renewal
    Answer: aredcanary​
22. One legitimate use of PowerShell by administrators is for:
    a. Script automation and remote management
    b. Blocking all user inputs
    c. File compression
    d. Antivirus deactivation
    Answer: aredcanary​
23. Adversaries use PowerShell to disable:
    a. Windows security tools
    b. Power adapter settings
    c. USB device enumeration
    d. Auto-updates
    Answer: aredcanary​
24. The MITRE ATT&CK sub-technique code for PowerShell is:
    a. T1059.001
    b. T1047.003
    c. T1098.004
    d. T1609.002
    Answer: aattack.mitre​
25. A PowerShell-based function vulnerable to injection is one using:
    a. Invoke-Expression with user inputs
    b. Read-Host only
    c. Write-Output
    d. ConvertTo-Json
    Answer: alearn.microsoft​
26. Fileless PowerShell attacks operate mainly in:
    a. Memory
    b. Swapdisk
    c. Cloud drives
    d. GPU
    Answer: acybereason​
27. PowerShell execution abuse is categorized under MITRE ATT&CK:
    a. Command and Scripting Interpreter
    b. Exfiltration via Cloud Storage
    c. Bootkit Execution layer
    d. Network Pivoting Tactic
    Answer: aattack.mitre​
28. PowerSploit is an example of:
    a. Exploit toolkit using PowerShell
    b. Antivirus scanner
    c. Microsoft Visual utility
    d. Router firmware module
    Answer: ablackfog​
29. PowerShell scripts can be prevented from running via configuration of:
    a. Execution policies
    b. Registry mirrors
    c. Group Policy scripts
    d. Event viewer
    Answer: acodecademy​
30. A common attacker goal when using PowerShell is:
    a. Lateral movement
    b. Device cooling
    c. Log file compression
    d. Hardware reset
    Answer: aelastic​
31. PowerShell scripts can remotely download and execute malicious code using:
    a. Invoke-WebRequest or Net.WebClient
    b. WMI-only access
    c. Disk checks
    d. Memory flush
    Answer: ablackfog​
32. PowerShell’s “AllSigned” policy is most used when:
    a. Only trusted publishers’ scripts should run
    b. There are no scripts in use
    c. Testing unsigned developer scripts
    d. Running Linux subsystems
    Answer: acodecademy​
33. PowerShell script execution attacks can lead to:
    a. Privilege escalation
    b. Reboot optimization
    c. Bluetooth connectivity loss
    d. Printer driver errors
    Answer: aelastic​
34. The cmdlet used to modify execution policy levels is:
    a. Set-ExecutionPolicy
    b. Change-PolicySetting
    c. Write-ExecutionPolicy
    d. PolicyAdjust
    Answer: acodecademy​
35. PowerShell script execution attacks are considered dangerous because:
    a. They blend with legitimate admin activity
    b. They permanently delete system apps
    c. They demand reinstallation of PowerShell
    d. They require physical access only
    Answer: aredcanary​
36. PowerShell’s command shell runs atop which runtime environment?
    a. .NET CLR
    b. JVM
    c. Python runtime
    d. GCC
    Answer: aredcanary​
37. PowerShell obfuscation often uses:
    a. Escaping characters such as backticks
    b. Color-coded outputs
    c. Random folder names
    d. Alternate keyboard layouts
    Answer: ablackfog​
38. A best defense against PowerShell abuse is to:
    a. Log all script executions
    b. Disable user logins
    c. Clear event logs nightly
    d. Change execution policy daily
    Answer: abeyondtrust​
39. Detecting abnormal PowerShell executions helps prevent:
    a. System compromise
    b. Device overheating
    c. Browser updates
    d. GPU overclocking
    Answer: aelastic​
40. PowerShell malicious payloads are often launched via:
    a. Phishing emails with encoded attachments
    b. System restore utilities
    c. Network switches
    d. BIOS firmware
    Answer: aredcanary​
41. To bypass PowerShell restrictions, adversaries may use:
    a. Alternative interpreters or compiled executables
    b. Nonexistent cmdlets
    c. Windows registry only
    d. File compression
    Answer: ablackfog​
42. In penetration testing, PowerShell helps automate:
    a. Reconnaissance
    b. Data erasure
    c. Software licensing
    d. User interface design
    Answer: aeccouncil​
43. When PowerShell execution policies are set to “Unrestricted”:
    a. Any script can run
    b. No scripts can execute
    c. Only Microsoft scripts run
    d. Registry edits are required
    Answer: acodecademy​
44. PowerShell script execution can result in:
    a. Remote code execution
    b. System shutdowns for updates
    c. Kernel panic
    d. Audio driver reset
    Answer: ablackfog​
45. Adversaries frequently disguise PowerShell commands through:
    a. Encoding and escaping syntax
    b. Role-based access control
    c. AppLocker bypass policies
    d. Local user creation
    Answer: ablackfog​
46. Red Canary reports that PowerShell attacks often involve:
    a. Encoded payloads from phishing attachments
    b. DNS tunneling
    c. Remote SSH brute force
    d. ICMP floods
    Answer: aredcanary​
47. In MITRE ATT&CK, the Command and Scripting Interpreter category includes:
    a. PowerShell, CMD, Python, VBScript
    b. SMTP, POP3, IMAP, SNMP
    c. ICMP, TCP, UDP, ARP
    d. Sandbox, VMX, BIOS, CMOS
    Answer: aelastic​
48. PowerShell scripts can be exploited to perform:
    a. Privilege escalation and lateral movement
    b. Hardware diagnostics
    c. Key rotation
    d. Power calibration
    Answer: aeccouncil​
49. When defenders fail to detect unauthorized script activity, attackers may achieve:
    a. Complete system compromise
    b. GPU overuse
    c. Memory balancing
    d. Application rollback
    Answer: aelastic​
50. The best practice to prevent PowerShell script execution attacks is to:
    a. Restrict script execution and monitor logs
    b. Uninstall PowerShell
    c. Disable Ethernet ports
    d. Block outbound DNS
    Answer: abeyondtrust+1​

1. https://attack.mitre.org/techniques/T1059/001/
2. https://redcanary.com/threat-detection-report/techniques/powershell/
3. https://learn.microsoft.com/en-us/powershell/scripting/security/preventing-script-injection?view=powershell-7.5
4. https://www.blackfog.com/knowledge-base/powershell-attack-prevention/
5. https://www.cybereason.com/blog/fileless-malware-powershell
6. https://www.codecademy.com/article/powershell-commands-for-cybersecurity-analysts
7. https://www.elastic.co/blog/detecting-command-scripting-interpreter
8. https://www.picussecurity.com/resource/blog/picus-10-critical-mitre-attck-techniques-t1059-command-line-interface
9. https://www.eccouncil.org/cybersecurity-exchange/penetration-testing/powershell-scripting-definition-use-cases/
10. https://www.beyondtrust.com/blog/entry/protecting-against-powershell-attacks-is-easier-than-you-think
11. https://www.freshersnow.com/powershell-quiz/
12. https://www.sanfoundry.com/cyber-security-questions-answers-exploits-exploitation/
13. https://www.scribd.com/document/877523188/Cybersecurity-SOC-MCQ-1
14. https://www.manageengine.com/log-management/cyber-security/powershell-cyberattacks.html
15. https://attack.mitre.org/techniques/T1059/
16. https://www.yeahhub.com/cyber-security-penetration-testing-multiple-choice-questions/
17. https://www.knowledgehut.com/interview-questions/powershell-interview-questions
18. https://www.paloaltonetworks.com/cyberpedia/what-are-mitre-attack-techniques
19. https://www.youtube.com/watch?v=wiAlgfm8krE
20. https://www.picussecurity.com/resource/blog/sub-techniques-of-command-and-scripting-interpreter-explained-mitre-attck-t1059