Code signing in PowerShell - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the output of this PowerShell code signing command?

Consider the following PowerShell command that attempts to sign a script file. What will be the output if the certificate thumbprint is invalid or not found?

PowerShell

Set-AuthenticodeSignature -FilePath script.ps1 -Certificate (Get-ChildItem Cert:\CurrentUser\My\INVALIDTHUMBPRINT)

A No output, command runs silently

B Script signed successfully

C Warning: Certificate expired

D Error: Cannot find certificate with thumbprint INVALIDTHUMBPRINT

💡 Hint

Think about what happens if the certificate object is null or empty.

If the certificate thumbprint does not match any certificate in the store, Get-ChildItem returns nothing, causing Set-AuthenticodeSignature to fail with an error about the missing certificate.

💻 Command Output

intermediate

What does this PowerShell snippet output when verifying a signed script?

Given a signed script file 'signedScript.ps1', what will this command output?

PowerShell

Get-AuthenticodeSignature -FilePath signedScript.ps1 | Select-Object Status

A

Status
-------
Valid

B

Status
-------
NotSigned

C

Status
-------
UnknownError

D

Status
-------
HashMismatch

💡 Hint

The script is signed and not tampered with.

Get-AuthenticodeSignature returns a Status property indicating the signature validity. For a properly signed and untampered script, the status is 'Valid'.

📝 Syntax

advanced

Which option correctly signs a script with a certificate from the CurrentUser store?

Select the PowerShell command that correctly signs 'myscript.ps1' using a certificate with thumbprint 'ABC123' from the CurrentUser\My store.

A Set-AuthenticodeSignature -FilePath myscript.ps1 -Certificate (Get-ChildItem Cert:\CurrentUser\My\ABC123)

B Set-AuthenticodeSignature -FilePath myscript.ps1 -Certificate (Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq 'ABC123' })

C Set-AuthenticodeSignature -FilePath myscript.ps1 -Certificate (Get-ChildItem Cert:\CurrentUser\Root\ABC123)

D Set-AuthenticodeSignature -FilePath myscript.ps1 -Certificate (Get-ChildItem Cert:\LocalMachine\My\ABC123)

💡 Hint

Get-ChildItem with a path ending with thumbprint does not work as expected; filtering is needed.

Get-ChildItem does not accept a thumbprint as a direct path segment. Instead, you list certificates and filter by Thumbprint property using Where-Object.

🔧 Debug

advanced

Why does this code signing command fail with a null certificate error?

Analyze the following code snippet and select the reason it fails with a null certificate error.

PowerShell

 $cert = Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Subject -like '*MyCert*' }
 Set-AuthenticodeSignature -FilePath script.ps1 -Certificate $cert

A Set-AuthenticodeSignature requires a file path with full absolute path

B $cert is null because the certificate store path is incorrect

C $cert contains multiple certificates, causing Set-AuthenticodeSignature to fail

D The script file 'script.ps1' does not exist

💡 Hint

Consider what happens if the filter returns more than one certificate.

If the filter returns multiple certificates, $cert becomes a collection, but Set-AuthenticodeSignature expects a single certificate object, causing an error.

🚀 Application

expert

How to automate signing multiple scripts with error handling in PowerShell?

You want to sign all '.ps1' files in a folder using a certificate with thumbprint 'DEF456'. Which script correctly signs each file and logs errors without stopping the entire process?

A

Get-ChildItem -Path . -Filter '*.ps1' | ForEach-Object {
  try {
    Set-AuthenticodeSignature -FilePath $_.FullName -Certificate (Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq 'DEF456' })
  } catch {
    Write-Output "Failed to sign $($_.Name): $_"
  }
}

B

foreach ($file in Get-ChildItem -Path . -Filter '*.ps1') {
  Set-AuthenticodeSignature -FilePath $file.FullName -Certificate (Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq 'DEF456' })
}

C

Get-ChildItem -Path . -Filter '*.ps1' | ForEach-Object {
  Set-AuthenticodeSignature -FilePath $_.FullName -Certificate (Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq 'DEF456' }) -ErrorAction SilentlyContinue
}

D

foreach ($file in Get-ChildItem -Path . -Filter '*.ps1') {
  try {
    Set-AuthenticodeSignature -FilePath $file.FullName -Certificate (Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq 'DEF456' })
  } catch {
    Write-Output "Error signing $($file.Name)"
    break
  }
}

💡 Hint

You want to continue signing even if one file fails and log the error.

Option A uses try-catch inside the loop to handle errors per file and logs failures without stopping the entire process. Option A stops on first error, B lacks error handling, C suppresses errors silently without logging.