Configuration drift detection in PowerShell - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Detecting drift by comparing file hashes

You have a baseline hash stored in a variable $baselineHash. Which command outputs true if the current file hash matches the baseline, indicating no drift?

PowerShell

$baselineHash = 'ABC123'
$currentHash = Get-FileHash -Path 'C:\config.txt' -Algorithm SHA256 | Select-Object -ExpandProperty Hash

A Compare-Object $currentHash $baselineHash

B $currentHash.Equals($baselineHash)

C $currentHash -ne $baselineHash

D $currentHash -eq $baselineHash

💡 Hint

Use the equality operator to compare strings in PowerShell.

Option D uses the -eq operator to check if the current hash equals the baseline hash, returning true if they match, meaning no drift.

Option D calls a method that works but returns a boolean, but in PowerShell, -eq is preferred for clarity.

Option D checks for inequality, which is the opposite of what is needed.

Option D returns a comparison object, not a boolean.

📝 Syntax

intermediate

Correct syntax for reading configuration file content

Which PowerShell command correctly reads the content of C:\config.txt into a variable $configContent for drift analysis?

A $configContent = Get-Content -Path 'C:\config.txt' -Raw

B $configContent = Read-File 'C:\config.txt'

C $configContent = Get-Content 'C:\config.txt' | Out-String

D $configContent = Read-Content -File 'C:\config.txt'

💡 Hint

Use the standard cmdlet to read file content as a single string.

Option A uses Get-Content with -Raw to read the entire file as one string, ideal for drift checks.

Option A and D use non-existent cmdlets.

Option A reads content line by line and converts to string, but may add unwanted newlines.

🚀 Application

advanced

Automating drift detection with scheduled task

You want to create a scheduled task that runs a PowerShell script DetectDrift.ps1 daily at 2 AM to check configuration drift. Which command correctly creates this scheduled task?

A Register-ScheduledTask -TaskName 'DriftCheck' -Trigger (New-ScheduledTaskTrigger -Daily -At 2am) -Action (New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-File C:\Scripts\DetectDrift.ps1')

B New-ScheduledTask -Name 'DriftCheck' -Daily -At 2am -ScriptPath 'C:\Scripts\DetectDrift.ps1'

C schtasks /create /tn DriftCheck /tr 'PowerShell.exe -File C:\Scripts\DetectDrift.ps1' /sc daily /st 02:00

D Set-ScheduledTask -TaskName 'DriftCheck' -Daily -At 2am -Script 'C:\Scripts\DetectDrift.ps1'

💡 Hint

Use PowerShell cmdlets to register a scheduled task with trigger and action.

Option A correctly uses Register-ScheduledTask with a daily trigger at 2 AM and an action to run PowerShell with the script.

Option A uses a non-existent cmdlet.

Option A is a valid schtasks command but is not PowerShell native cmdlet.

Option A uses a non-existent cmdlet and parameters.

🔧 Debug

advanced

Identify the error in this drift detection script snippet

What error will this script produce?

$baselineHash = 'ABC123'
$currentHash = Get-FileHash -Path 'C:\config.txt' -Algorithm SHA256
if ($currentHash -eq $baselineHash) { Write-Output 'No drift' } else { Write-Output 'Drift detected' }

A Runtime error because Get-FileHash requires admin privileges

B SyntaxError due to missing parentheses in the if statement

C false because $currentHash is an object, not a string, causing the comparison to fail

D No error, outputs 'No drift' or 'Drift detected' correctly

💡 Hint

Check the type of $currentHash and what is being compared.

$currentHash is an object with properties, not just the hash string. Comparing it directly to a string will fail.

The correct approach is to compare $currentHash.Hash to $baselineHash.

🧠 Conceptual

expert

Understanding configuration drift detection strategy

Which statement best describes the main goal of configuration drift detection in automation scripts?

A To encrypt configuration files to protect sensitive data from unauthorized access.

B To continuously monitor and identify changes in system configuration that differ from a defined baseline, enabling timely remediation.

C To automatically update all system configurations to the latest software versions without manual checks.

D To backup configuration files daily to prevent data loss in case of system failure.

💡 Hint

Think about what 'drift' means in configuration management.

Configuration drift detection focuses on finding differences from a known good baseline to keep systems consistent.

Options A, B, and C describe other tasks not directly related to drift detection.

Practice

1. What is the main purpose of configuration drift detection in PowerShell?

easy

A. To delete temporary files from the system

B. To find unexpected changes in system settings

C. To create new user accounts on a system

D. To install new software updates automatically

Solution

1. Step 1: Understand configuration drift detection

   Configuration drift detection is about identifying changes that were not planned or expected in system settings.

2. Step 2: Match the purpose with options

   Among the options, only finding unexpected changes matches the purpose of configuration drift detection.

3. Final Answer:

   To find unexpected changes in system settings -> Option B

4. Quick Check:

   Configuration drift detection = find unexpected changes [OK]

Hint: Remember: drift means unexpected changes [OK]

Common Mistakes:

• Confusing drift detection with software installation
• Thinking it manages user accounts
• Assuming it cleans files automatically

2. Which PowerShell command is used to compare baseline and current configurations for drift detection?

easy

A. Compare-Object

B. Get-Content

C. Set-Item

D. New-Item

Solution

1. Step 1: Identify the command for comparing objects

   PowerShell's Compare-Object command compares two sets of data, perfect for detecting differences.

2. Step 2: Eliminate unrelated commands

   Get-Content reads files, Set-Item changes values, New-Item creates items. None compare data sets.

3. Final Answer:

   Compare-Object -> Option A

4. Quick Check:

   Compare-Object compares configurations [OK]

Hint: Use Compare-Object to spot differences fast [OK]

Common Mistakes:

• Using Get-Content instead of Compare-Object
• Confusing Set-Item with comparison
• Trying New-Item to detect drift

3. Given these two arrays in PowerShell:

$baseline = @('Setting1', 'Setting2', 'Setting3')
$current = @('Setting1', 'Setting2', 'Setting4')

What will be the output of Compare-Object $baseline $current?

medium

A. Setting1 and Setting2 are different

B. No differences found

C. Setting3 is in baseline only; Setting4 is in current only

D. Error: Cannot compare arrays

Solution

1. Step 1: Compare the two arrays

   Baseline has Setting3; current has Setting4 instead. Setting1 and Setting2 are common.

2. Step 2: Understand Compare-Object output

   It shows items only in one array with a side indicator. So Setting3 appears only in baseline, Setting4 only in current.

3. Final Answer:

   Setting3 is in baseline only; Setting4 is in current only -> Option C

4. Quick Check:

   Compare-Object shows differences = Setting3 is in baseline only; Setting4 is in current only [OK]

Hint: Look for items unique to each list [OK]

Common Mistakes:

• Assuming no differences when there are
• Thinking common items show as differences
• Expecting an error from Compare-Object

4. You run this PowerShell command to detect drift:

Compare-Object $baseline $current -Property Name

But you get an error saying property 'Name' does not exist. What is the likely cause?

medium

A. The objects in $baseline and $current do not have a 'Name' property

B. Compare-Object cannot compare properties

C. You must use -IncludeEqual to avoid errors

D. The arrays are empty

Solution

1. Step 1: Understand the -Property parameter

   -Property expects objects with that property to compare by it.

2. Step 2: Check the data type of arrays

   If arrays contain strings, they have no 'Name' property, causing the error.

3. Final Answer:

   The objects in $baseline and $current do not have a 'Name' property -> Option A

4. Quick Check:

   Property error means missing property in objects [OK]

Hint: Check object properties before using -Property [OK]

Common Mistakes:

• Thinking Compare-Object can't compare properties
• Believing -IncludeEqual fixes property errors
• Assuming empty arrays cause this error

5. You want to detect configuration drift by comparing two JSON files representing system settings. Which PowerShell approach correctly detects drift?

hard

A. Import both JSON files with Get-Content and compare strings directly

B. Use Get-Content with -Raw and compare with -eq operator

C. Manually open files and visually check for differences

D. Use ConvertFrom-Json on both files, then Compare-Object on resulting objects

Solution

1. Step 1: Understand JSON comparison needs

   Comparing JSON as strings can fail due to formatting differences; converting to objects is better.

2. Step 2: Use ConvertFrom-Json and Compare-Object

   ConvertFrom-Json parses JSON into objects; Compare-Object can then detect differences in properties.

3. Final Answer:

   Use ConvertFrom-Json on both files, then Compare-Object on resulting objects -> Option D

4. Quick Check:

   Convert JSON to objects before comparing [OK]

Hint: Parse JSON to objects before comparing [OK]

Common Mistakes:

• Comparing raw JSON strings directly
• Using -eq operator for complex objects
• Relying on manual visual checks