The OSCP exam is a hands-on penetration testing challenge. Understanding the offensive security certified professional cost is important for budgeting. Candidates must connect to a live network via VPN and compromise a series of target machines within 23 hours and 45 minutes, followed by 24 hours to submit a comprehensive penetration test report. Practice with the free OSCP - Offensive Security Certified Professional practice test on PracticeTestGeeks (7 questions with answer explanations).

Test-takers preparing for elearnsecurity junior penetration will find our eJPT certification 2026 invaluable for mastering the content and format before exam day.

OSCP Exam at a Glance

Facts verified Nov 9, 2026 against OffSec. Dates that have passed are removed automatically.

Free OSCP - Offensive Security Certified Professional Study Tools

Interactive OSCP - Offensive Security Certified Professional resources on PracticeTestGeeks, free to start:

• OSCP - Offensive Security Certified Professional flashcards — review key terms and concepts card by card
• OSCP - Offensive Security Certified Professional study guide — topic-by-topic overview of what the exam covers
• OSCP - Offensive Security Certified Professional cheat sheet — one-page printable summary for last-minute review

According to OffSec, “The minimum age to enroll in any of our courses and exams is 18 years old.”^[7]

Worked examples: how to reason through OSCP questions

These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.

Example 1

Question: In Kali Linux, what does the 'crunch' tool generate and how is it used in OSCP scenarios?

1. Generates network packet captures for analysis
2. Generates custom wordlists based on character sets and length parameters
3. Generates SSL certificates for MITM attacks
4. Generates exploit shellcode patterns

Answer: B. Generates custom wordlists based on character sets and length parameters

Explanation:

The correct answer is that crunch generates custom wordlists. You give it a minimum and maximum length and a character set, and it writes every combination. That is useful when you know something about a password policy and want a targeted list instead of a generic one.

Packet captures come from tools such as tcpdump or Wireshark, so the first option describes the wrong job. Certificates for a man-in-the-middle setup are made with tools like openssl, not crunch. Shellcode patterns come from payload generators such as msfvenom, and crunch has no part in that.

The rule to remember: learn each Kali tool by the single output it produces. If a question names the output, such as a wordlist, a capture, a certificate or a payload, the tool follows from it.

Example 2

Question: Which directory you are in can be determined

1. pwd
2. man
3. whoami
4. --help

Answer: A. pwd

Explanation:

The correct answer is pwd, short for print working directory. It prints the full path of the directory your shell is currently in. That matters in practice because a command run in the wrong directory can read, write or delete the wrong files.

man opens the manual page for a command, so it explains how to use something but says nothing about where you are. whoami prints the name of the user you are logged in as, which is a different question from your location. --help is a flag added to a command to print its usage summary, not a command that reports your directory.

The rule to remember: location is pwd, identity is whoami, documentation is man or --help. Keep these straight, because you will run them constantly while orienting yourself on a new machine.

Example 3

Question: In Kali Linux, what is the primary use of the 'sslstrip' tool during a man-in-the-middle attack?

1. Strips SSL certificates from a web server
2. Downgrades HTTPS connections to HTTP to intercept credentials in cleartext
3. Removes SSL pinning from Android APKs
4. Decrypts SSL traffic using stolen private keys

Answer: B. Downgrades HTTPS connections to HTTP to intercept credentials in cleartext

Explanation:

The correct answer is that sslstrip downgrades HTTPS connections to HTTP. It sits in the middle of a connection, watches for redirects to HTTPS and keeps the victim talking plain HTTP while it speaks HTTPS to the real server. Credentials then cross the victim's side of the link in cleartext where the attacker can read them.

Stripping certificates from a web server is not what it does, because it works on the traffic path and does not modify the server. Removing SSL pinning from Android APKs is a mobile reverse-engineering task handled by other tooling. Decrypting traffic with stolen private keys needs the key material, and sslstrip needs no keys at all.

The rule to remember: sslstrip avoids encryption by never letting the client start it, and it does not break the encryption itself.

How to use these practice tests

Start with the official OffSec material so you know what the exam asks of you, and read the exam guide closely, including the proctoring rules. Treat our practice sets as a way to find weak spots, because they are multiple choice and the real exam is entirely hands-on.

Work through the sets by topic. Begin with Linux and Kali Linux if the command line still feels slow, since everything else depends on it. Then move to network scanning and enumeration, which feeds every later step. After that, take password attacks and cracking, web application attacks, Windows privilege escalation and buffer overflows.

After each set, read the explanation for every question you missed, then open a terminal or lab machine and do the task yourself. If you got crunch or sslstrip wrong, run the tool and look at its output. A concept you have typed out stays with you better than one you have only read.

Keep notes as you practise, in the same form you will need for the report you submit after the exam. Write down commands, what they returned and what you decided next. Near test day, repeat the sets you struggled with, check your appointment details with OffSec and read the retake rules so you know the cost and waiting periods before you sit.

While the OSCP cost is higher than multiple-choice certifications, it includes comprehensive training and lab access. The "Learn One" bundle is popular as it offers a second OSCP exam attempt and a full year of lab access, maximizing your chance of passing.

Ready to Pass Your OSCP Exam?

Get started with our free OSCP practice test questions. Simulate the exam environment, identify your weak points, and master the tools needed for the Offensive Security OSCP challenge.

Unlike many other certifications, the OSCP certification from OffSec requires no maintenance fees or continuing education units. Your skills are proven by the rigorous exam, and the title remains yours permanently.

Pros and Cons at a Glance

Sample OSCP - Offensive Security Certified Professional Practice Questions

Try these questions from our free OSCP - Offensive Security Certified Professional practice tests. The correct answer and an explanation follow each question.

1. Which Nmap flag combination is commonly recommended for a comprehensive initial OSCP scan?

   • A. -sV -sC -p- -T4
   • B. -sT -O -F
   • C. -sN -sX -sF
   • D. -sU -sV --open

   Answer: A. -sV -sC -p- -T4

   The combination -sV -sC -p- -T4 scans all 65535 ports with service version detection and default scripts at an aggressive timing template.

2. Which tool is used during OSCP to enumerate misconfigured Windows services for privilege escalation?

   • A. Mimikatz
   • B. WinPEAS
   • C. PowerSploit
   • D. BloodHound

   Answer: B. WinPEAS

   WinPEAS (Windows Privilege Escalation Awesome Script) automatically enumerates potential privilege escalation vectors including misconfigured services, DLL hijacking paths, and unquoted service paths.

3. During OSCP buffer overflow labs, the 'spike' tool is used. What is its primary function?

   • A. It generates cyclic De Bruijn sequences for offset finding
   • B. It performs protocol fuzzing by sending malformed data to network services
   • C. It scans for JMP ESP gadgets in loaded modules
   • D. It captures crash dumps from a running process

   Answer: B. It performs protocol fuzzing by sending malformed data to network services

   SPIKE is a fuzzing framework that sends progressively mutated protocol-aware input to network services to identify crash-inducing inputs.

4. After successfully exploiting a buffer overflow to get a reverse shell, you find you have low-privileged access. What OSCP methodology comes next?

   • A. Re-exploit the same vulnerability with a different payload to get SYSTEM
   • B. Perform local privilege escalation enumeration to elevate from the current user
   • C. Use the buffer overflow to inject a second shellcode directly as SYSTEM
   • D. Restart the exploit with a bind shell instead of a reverse shell

   Answer: B. Perform local privilege escalation enumeration to elevate from the current user

   Post-exploitation privilege escalation (checking misconfigurations, unquoted paths, weak service permissions, etc.) is the next step after gaining initial access.

Take the full OSCP - Offensive Security Certified Professional practice test