OSCP - Offensive Security Certified Professional — Questions and Answers

Question 1: Which service typically runs on port 3306 and is a common target for enumeration in OSCP labs?

Oracle Database
PostgreSQL
MySQL/MariaDB (Correct answer)
Microsoft SQL Server

Correct answer: MySQL/MariaDB

Port 3306 is the default port for MySQL and MariaDB database servers, which are frequently found in OSCP lab environments.

Question 2: What is the CrackMapExec (CME/NetExec) tool primarily used for in OSCP Windows environments?

Performing web application SQL injection attacks
Executing commands, spraying credentials, and enumerating Windows/AD environments over SMB/WinRM (Correct answer)
Generating custom wordlists from target information
Cracking captured password hashes offline

Correct answer: Executing commands, spraying credentials, and enumerating Windows/AD environments over SMB/WinRM

CrackMapExec (now NetExec) is a Swiss army knife for Windows/AD environments, supporting credential spraying, command execution, secrets dumping, and enumeration over SMB, WinRM, LDAP, and MSSQL.

Question 3: _____________ is another name for buffer-overflow.

buffer-overrun (Correct answer)
memory leakage
data overflow
buffer-leak

Correct answer: buffer-overrun

Buffer-overrun is indeed another common name for buffer-overflow. Both terms refer to the same type of vulnerability where a program attempts to write data past the end (or sometimes the beginning) of a fixed-length buffer. This can lead to memory corruption, program crashes, or the execution of arbitrary code by an attacker.

Question 4: File for creating cron jobs.

/var/log
/etc/mtab
/etc/crontab (Correct answer)
/etc/fstab

Correct answer: /etc/crontab

The `/etc/crontab` file is a system-wide configuration file used to schedule cron jobs, which are automated tasks that run at specified intervals. This file defines the commands to be executed and their respective schedules, allowing system administrators to automate routine maintenance, backups, and other operations without manual intervention. It's a central point for managing recurring system tasks.

Question 5: A _________ is a sequential section of memory that has been set aside for holding data, like a character string or an array of numbers.

stack
external storage
buffer (Correct answer)
queue

Correct answer: buffer

A buffer is a temporary storage area in memory used to hold data while it is being transferred from one location to another. It acts as an intermediate space to manage data flow, often compensating for differences in processing speeds between devices or processes. This definition perfectly describes a sequential section of memory set aside for holding data like strings or arrays.

Question 6: Which Kali Linux tool is specifically designed for brute-forcing web application login forms over HTTP?

medusa -M ssh
hydra with http-post-form module (Correct answer)
john --wordlist
ncrack -p 80

Correct answer: hydra with http-post-form module

Hydra's http-post-form module allows specifying the form URL, parameters, and failure string to brute-force web login forms.

Question 7: Which Kali Linux feature allows you to run multiple terminal sessions within a single window, useful for monitoring listeners while conducting exploits?

tmux or screen multiplexers (Correct answer)
xterm split mode
Kali terminal tabs only
The built-in Kali panel manager

Correct answer: tmux or screen multiplexers

tmux and screen are terminal multiplexers that allow splitting a terminal into multiple panes and maintaining persistent sessions, essential for OSCP multi-task work.

Question 8: What Nmap script category is most useful for initial service version detection during OSCP enumeration?

--script=default (Correct answer)
--script=auth
--script=vuln
--script=exploit

Correct answer: --script=default

The 'default' script category runs commonly useful scripts that are safe, reliable, and provide helpful service information without being intrusive.

Question 9: Which Nmap timing template (-T) value provides the most aggressive scan speed?

-T4
-T2
-T3
-T5 (Correct answer)

Correct answer: -T5

The -T5 'insane' timing template is the most aggressive, sending packets as fast as possible at the risk of missing results due to network congestion.

Question 10: Which registry hive contains Windows auto-run entries that execute programs at system startup, useful for persistence?

HKEY_CURRENT_CONFIG\System\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (Correct answer)
HKEY_CLASSES_ROOT\CLSID\Run
HKEY_USERS\Default\Run

Correct answer: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key contains entries that execute programs at system startup for all users, making it a common persistence and privilege escalation target.

Question 11: What does the acronym 'OSINT' stand for in the context of OSCP reconnaissance?

Online System Information and Tracking
Offensive System Integrated Network Testing
Open Source Intelligence (Correct answer)
Operational Security Intrusion Network Tool

Correct answer: Open Source Intelligence

OSINT (Open Source Intelligence) refers to collecting information from publicly available sources like websites, social media, WHOIS records, and DNS data.

Question 12: In Kali Linux, which command would you use to forward local port 8080 to a remote host's port 80 via SSH tunneling?

ssh -R 8080:remotehost:80 user@sshserver
ssh -P 8080 user@sshserver
ssh -L 8080:remotehost:80 user@sshserver (Correct answer)
ssh -D 8080 user@sshserver

Correct answer: ssh -L 8080:remotehost:80 user@sshserver

ssh -L 8080:remotehost:80 creates a local port forward, binding local port 8080 and tunneling connections through the SSH server to remotehost:80.

Question 13: Which HTTP method is most commonly exploited to upload a malicious web shell to a vulnerable web server?

GET
DELETE
PUT (Correct answer)
OPTIONS

Correct answer: PUT

The HTTP PUT method allows clients to upload files to a server; if misconfigured, attackers can upload a web shell granting remote code execution.

Question 14: What Windows privilege escalation technique abuses the SeImpersonatePrivilege token right?

UAC bypass via fodhelper
Pass-the-Hash
Juicy Potato / PrintSpoofer token impersonation (Correct answer)
DLL hijacking via PATH

Correct answer: Juicy Potato / PrintSpoofer token impersonation

SeImpersonatePrivilege allows impersonating authentication tokens; tools like Juicy Potato, RoguePotato, and PrintSpoofer exploit this to impersonate the SYSTEM token and gain full privileges.

Question 15: When enumerating NFS shares during OSCP, which command shows available exports on a target?

showmount -e <target> (Correct answer)
mount -t nfs <target>:/
rpcinfo --list <target>
nfsstat -m <target>

Correct answer: showmount -e <target>

The 'showmount -e' command queries the NFS server and displays its list of exported directories along with any access restrictions.

Question 16: What is User Account Control (UAC) bypass and why is it important during OSCP?

Bypassing antivirus to execute malware
Elevating from a medium-integrity admin account to a high-integrity process without triggering UAC prompts (Correct answer)
Bypassing Windows login screens using cached credentials
Gaining access to other user accounts on the system

Correct answer: Elevating from a medium-integrity admin account to a high-integrity process without triggering UAC prompts

UAC bypass techniques allow an already-administrative but medium-integrity process to elevate to high integrity without displaying a UAC consent prompt, completing the privilege escalation.

Question 17: Which tool is used to perform DNS zone transfer attacks during OSCP reconnaissance?

whois -d
host -t MX
nslookup -type=A
dig axfr (Correct answer)

Correct answer: dig axfr

The command 'dig axfr @<nameserver> <domain>' requests a full DNS zone transfer, which can reveal all DNS records if the server is misconfigured.

Question 18: In Kali Linux, what does the 'crunch' tool generate and how is it used in OSCP scenarios?

Generates custom wordlists based on character sets and length parameters (Correct answer)
Generates exploit shellcode patterns
Generates network packet captures for analysis
Generates SSL certificates for MITM attacks

Correct answer: Generates custom wordlists based on character sets and length parameters

Crunch creates custom wordlists by specifying minimum/maximum length and character sets, useful for targeted password attacks when password policy is known.

Question 19: Which command would you use with Nmap to enumerate SNMP services running on UDP port 161?

nmap -sU -p 161 --script=snmp-info <target> (Correct answer)
nmap -sV -p 161 --script=http-info <target>
nmap -sT -p 161 --script=snmp-brute <target>
nmap -sS -p 161 --script=ftp-anon <target>

Correct answer: nmap -sU -p 161 --script=snmp-info <target>

SNMP runs on UDP port 161, so you must use -sU for a UDP scan combined with the snmp-info script to enumerate SNMP information.

Question 20: What does the 'whoami /priv' command reveal that is useful for Windows privilege escalation?

Currently running services and their permissions
The current user's password hash
The user's group memberships and enabled/disabled token privileges (Correct answer)
All users on the local system

Correct answer: The user's group memberships and enabled/disabled token privileges

The 'whoami /priv' command lists all privilege tokens assigned to the current user, revealing potentially exploitable privileges like SeImpersonatePrivilege or SeDebugPrivilege.

Question 21: In Kali Linux, what is the function of 'responder' during an internal network engagement?

Responds to ICMP ping requests
Poisons LLMNR/NBT-NS/mDNS requests to capture NTLMv2 hashes (Correct answer)
Responds to ARP requests to build a network map
Intercepts and responds to HTTP requests

Correct answer: Poisons LLMNR/NBT-NS/mDNS requests to capture NTLMv2 hashes

Responder listens for LLMNR, NBT-NS, and mDNS broadcast queries and responds to them, tricking hosts into authenticating and capturing NTLMv2 credential hashes.

Question 22: What is a 'scheduled task' privilege escalation in Windows and what must be true for it to work?

The task runs under a higher-privileged account and the current user can modify the task's action or its script/binary (Correct answer)
The task must run every minute to be exploitable
The attacker must have admin rights to modify scheduled tasks
The task must be created by the SYSTEM account only

Correct answer: The task runs under a higher-privileged account and the current user can modify the task's action or its script/binary

Scheduled task escalation works when a task runs as a privileged user (e.g., SYSTEM) and the current user can overwrite the script or binary that the task executes.

Question 23: Which command in Kali Linux displays active network connections along with the process name and PID?

ip route show
ss -tlnp
netstat -an
netstat -tulnp (Correct answer)

Correct answer: netstat -tulnp

netstat -tulnp shows TCP/UDP listening ports along with the program name and PID, making it ideal for enumerating services.

Question 24: Which protocol and port combination indicates an LDAP service that might be enumerated for Active Directory information?

TCP 389 (Correct answer)
TCP 445
UDP 161
UDP 137

Correct answer: TCP 389

LDAP (Lightweight Directory Access Protocol) runs on TCP port 389 and is used by Active Directory for directory queries, making it a valuable enumeration target.

Question 25: Which PowerShell command checks whether the current user can modify a specific service's binary?

Test-Path -Service 'servicename'
Get-Service -Name 'name' | Select-Object *
icacls /check 'C:\path\to\service.exe'
Get-Acl -Path 'C:\path\to\service.exe' | Format-List (Correct answer)

Correct answer: Get-Acl -Path 'C:\path\to\service.exe' | Format-List

Get-Acl retrieves the security descriptor (ACL) of a file, revealing which users have read, write, or modify permissions on the service binary.

Question 26: What is the default password for many network devices and why is testing for default credentials important in OSCP?

Default passwords are always 'admin/admin' across all vendors
Vendors ship devices with known default credentials that administrators often forget to change, providing easy access (Correct answer)
Default credentials only work during initial device setup and expire automatically
Testing defaults is prohibited in OSCP engagement rules

Correct answer: Vendors ship devices with known default credentials that administrators often forget to change, providing easy access

Many administrators fail to change vendor-supplied default credentials, making default credential testing one of the highest-value, lowest-effort checks during OSCP penetration testing.

Question 27: What does the Responder tool do and how is it used in OSCP for credential capture?

It brute-forces passwords against network services
It poisons LLMNR/NBT-NS/mDNS broadcast queries to capture NTLMv2 hashes from network hosts (Correct answer)
It performs ARP spoofing to intercept cleartext credentials
It replays captured tickets against Kerberos services

Correct answer: It poisons LLMNR/NBT-NS/mDNS broadcast queries to capture NTLMv2 hashes from network hosts

Responder responds to LLMNR, NBT-NS, and mDNS broadcast queries with poisoned responses, tricking Windows hosts into authenticating to the attacker's machine and capturing their NTLMv2 hashes.

Question 28: Carl is looking to make a folder. What instruction should he issue?

rmdir
nano
mkdir (Correct answer)
Touch

Correct answer: mkdir

The `mkdir` command (short for 'make directory') is used in Linux to create new directories (folders) in the file system. Users specify the desired name for the new directory as an argument to the command, and it will be created in the current working directory unless a full path is provided. This is the standard and most direct instruction for creating folders.

Question 29: Buffer-overflow may remain as a bug in apps if __________ are not done fully

memory checks
buffer checks
boundary checks (Correct answer)
boundary hacks

Correct answer: boundary checks

Buffer-overflow vulnerabilities often persist in applications due to insufficient 'boundary checks'. These checks are crucial for ensuring that the amount of data being written to a buffer does not exceed its allocated size. Without proper boundary checks, excess data can overwrite adjacent memory, creating exploitable security flaws.

Question 30: In Kali Linux, which command updates the package database AND upgrades all installed packages in a single step?

apt-get upgrade
apt-get update && apt-get upgrade (Correct answer)
apt-get dist-upgrade
apt-get update

Correct answer: apt-get update && apt-get upgrade

Running apt-get update refreshes the package list, then apt-get upgrade installs newer versions; both must be chained to accomplish both tasks.

Question 31: What does the Kali Linux tool 'enum4linux' enumerate when run against a Windows or Samba target?

HTTP directories and files
Open TCP/UDP ports
SMB shares, users, groups, policies, and password policies (Correct answer)
SNMP community strings

Correct answer: SMB shares, users, groups, policies, and password policies

enum4linux wraps smbclient and rpcclient to enumerate SMB shares, domain users, groups, and password policy information from Windows and Samba hosts.

Question 32: Which Kali Linux command generates a reverse shell payload as an ELF binary for a Linux target?

msfconsole -e reverse_tcp
msfvenom -p linux/x86/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f elf (Correct answer)
msfvenom -p windows/shell_reverse_tcp -f exe
msfvenom --shellcode linux reverse

Correct answer: msfvenom -p linux/x86/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f elf

msfvenom with the linux/x86/shell_reverse_tcp payload and -f elf format generates a Linux ELF reverse shell binary.

Question 33: What Kali Linux tool performs passive OS fingerprinting by analyzing traffic captures without sending any packets?

xprobe2
unicornscan
nmap -O
p0f (Correct answer)

Correct answer: p0f

p0f (Passive OS Fingerprinting) identifies operating systems by analyzing TCP/IP stack characteristics in captured traffic without generating any probe packets.

Question 34: Where system binaries (programs) are stored

/usr
/dev
/etc
/sbin (Correct answer)

Correct answer: /sbin

The `/sbin` directory (short for 'system binaries') in Linux contains essential system administration binaries that are typically used by the root user for system maintenance and management. These programs are crucial for booting, restoring, and repairing the system, and are distinct from user-level binaries found in `/bin` or `/usr/bin`, which are for general user commands.

Question 35: What tool provides an automated network and service enumeration report, similar to running multiple tools in sequence?

AutoRecon (Correct answer)
Metasploit db_autopwn
SQLmap --crawl
Nikto --Format

Correct answer: AutoRecon

AutoRecon is a multi-threaded network reconnaissance tool that automatically runs multiple scanning tools and organizes results into a structured directory.

Question 36: What is the significance of finding 'SeBackupPrivilege' on a Windows account during OSCP?

It allows the user to restore files to any location
It enables reading event logs from all Windows sources
It allows bypassing filesystem ACLs to read any file, including the SAM and SYSTEM hives (Correct answer)
It grants full network access to all shares

Correct answer: It allows bypassing filesystem ACLs to read any file, including the SAM and SYSTEM hives

SeBackupPrivilege allows reading any file on the system regardless of ACLs, enabling an attacker to copy the SAM and SYSTEM registry hives and extract all local password hashes offline.

Question 37: Which Kali Linux command would enumerate all users on a Linux system that have a valid login shell?

who -a
finger -l
cat /etc/passwd | grep -v nologin | grep -v false (Correct answer)
getent passwd --shell

Correct answer: cat /etc/passwd | grep -v nologin | grep -v false

Filtering /etc/passwd to exclude 'nologin' and 'false' shells reveals accounts with valid interactive login shells.

Question 38: Which Kali Linux tool is used to create a persistent USB drive that saves changes across reboots?

live-build
mkusb
dd with persistence partition (Correct answer)
live-usb-creator

Correct answer: dd with persistence partition

A persistent Kali USB is created by partitioning the drive with a 'persistence' labeled ext4 partition alongside the ISO written with dd.

Question 39: When using Kali Linux's Wireshark, what display filter would show only HTTP GET requests?

tcp.flags.syn == 1
tcp.port == 80
http.request.method == 'GET' (Correct answer)
http.method.get

Correct answer: http.request.method == 'GET'

The Wireshark display filter http.request.method == "GET" isolates packets containing HTTP GET requests for analysis.

Question 40: During an OSCP lab, you find port 111 open on a Linux target. What service is most likely running?

LDAP directory
Portmapper/RPC (Correct answer)
HTTP proxy
DNS resolver

Correct answer: Portmapper/RPC

Port 111 is used by the Portmapper (rpcbind) service, which maps RPC program numbers to network port numbers and is commonly found on Linux/Unix systems.

Question 41: What is the difference between online and offline password attacks?

Online attacks require internet access; offline attacks work on a local network
Online attacks guess passwords against live services; offline attacks crack captured hashes without network interaction (Correct answer)
Online attacks target web applications; offline attacks target desktop apps
Online attacks use wordlists; offline attacks use brute force only

Correct answer: Online attacks guess passwords against live services; offline attacks crack captured hashes without network interaction

Online attacks authenticate against live services (SSH, FTP, RDP) and are rate-limited and detectable, while offline attacks crack captured password hashes locally without network interaction.

Question 42: Which hashcat attack mode uses a wordlist to crack password hashes?

Mode 3 (Mask attack)
Mode 1 (Combination attack)
Mode 6 (Hybrid Wordlist + Mask)
Mode 0 (Straight/Wordlist attack) (Correct answer)

Correct answer: Mode 0 (Straight/Wordlist attack)

Hashcat mode 0 (straight attack) uses a wordlist file, testing each word as a potential password, making it the most common starting point for cracking captured hashes.

Question 43: Which Nmap flag combination is commonly recommended for a comprehensive initial OSCP scan?

-sN -sX -sF
-sU -sV --open
-sV -sC -p- -T4 (Correct answer)
-sT -O -F

Correct answer: -sV -sC -p- -T4

The combination -sV -sC -p- -T4 scans all 65535 ports with service version detection and default scripts at an aggressive timing template.

Question 44: Which Nmap output format is most useful for importing results into other tools during OSCP?

-oG (grepable)
-oS (script kiddie)
-oX (XML) (Correct answer)
-oN (normal)

Correct answer: -oX (XML)

The -oX XML output format is the most versatile for importing into tools like Metasploit, OpenVAS, and other security platforms that parse XML.

Question 45: What is the purpose of the '/usr/share/wordlists/rockyou.txt' file in Kali Linux?

A list of common vulnerability names and CVEs
A list of common web directories for directory busting
A large password wordlist extracted from a real-world data breach used for dictionary attacks (Correct answer)
A list of common usernames for brute-force attacks

Correct answer: A large password wordlist extracted from a real-world data breach used for dictionary attacks

rockyou.txt contains approximately 14 million passwords from the 2009 RockYou data breach and is the most commonly used wordlist for password cracking in Kali.

Question 46: Which one provides details on the command

mkdir
man (Correct answer)
rm
su

Correct answer: man

The `man` command (short for 'manual') is used in Linux to display the manual pages for commands, utilities, and functions. It provides comprehensive documentation, including a description of the command, its syntax, options, and examples. This makes `man` an invaluable tool for users to understand how to effectively use various command-line tools and system functions.

Question 47: Where .so (Library file, stands for "shared object") are stored (basically like Windows .dll files).

/lib (Correct answer)
/etc
/boot
/bin

Correct answer: /lib

In the Linux file system hierarchy, the `/lib` directory (or `/usr/lib` for non-essential libraries) is where shared libraries, often ending with the `.so` extension (shared object), are stored. These files are analogous to `.dll` files in Windows and contain code that can be used by multiple programs, allowing for efficient resource sharing and modularity across the system.

Question 48: What does the Nmap -A flag enable?

Anonymous login detection only
Aggressive brute-force mode
All UDP ports scan
OS detection, version detection, script scanning, and traceroute (Correct answer)

Correct answer: OS detection, version detection, script scanning, and traceroute

The -A flag enables aggressive mode, which combines OS detection (-O), version scanning (-sV), script scanning (-sC), and traceroute in a single flag.

Question 49: What is the purpose of the 'AlwaysInstallElevated' Windows policy and how is it exploited?

It ensures all services run with SYSTEM privileges
It allows all users to install updates without admin rights — exploited by creating malicious MSI packages (Correct answer)
It automatically elevates PowerShell sessions
It bypasses UAC for all signed applications

Correct answer: It allows all users to install updates without admin rights — exploited by creating malicious MSI packages

When AlwaysInstallElevated is enabled in both HKCU and HKLM, any user can install MSI packages with SYSTEM privileges, allowing privilege escalation via a crafted malicious MSI file.

Question 50: What is the Kali Linux command to start the PostgreSQL database service required by Metasploit?

msfdb init
systemctl start metasploit
Both commands are needed — service postgresql start then msfdb init (Correct answer)
service postgresql start

Correct answer: Both commands are needed — service postgresql start then msfdb init

PostgreSQL must first be started with 'service postgresql start', then 'msfdb init' initializes and connects the Metasploit database.

Question 51: What is credential spraying and why is it preferred over traditional brute-force in Active Directory environments?

Testing one password against all users avoids account lockout policies that trigger after multiple failed attempts per account (Correct answer)
It is faster than brute-force because it uses GPU acceleration
It bypasses network firewalls by distributing attack traffic
It only requires one network packet per attempt, reducing bandwidth

Correct answer: Testing one password against all users avoids account lockout policies that trigger after multiple failed attempts per account

Credential spraying tries a single common password against many accounts, staying under the failed-attempt threshold per account and avoiding lockouts, unlike brute-force which exhausts all passwords against one account.

Question 52: Which command in Kali Linux sets a file's SUID bit to make it execute with the owner's privileges?

chmod +x filename
chmod 777 filename
chown root filename
chmod u+s filename (Correct answer)

Correct answer: chmod u+s filename

chmod u+s sets the SUID bit on a file, causing it to run with the file owner's effective privileges — a key privilege escalation vector.

Question 53: What tool is best suited for enumerating SMB shares on a Windows target during an OSCP engagement?

gobuster
enum4linux (Correct answer)
dirb
wfuzz

Correct answer: enum4linux

Enum4linux is a tool for enumerating information from Windows and Samba systems, including shares, users, groups, and password policies.

Question 54: What Hydra command would brute-force SSH on host 10.10.10.10 using username 'admin' with the rockyou wordlist?

hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.10 ssh (Correct answer)
hydra --user admin --wordlist rockyou.txt --service ssh 10.10.10.10
hydra -u admin -w /usr/share/wordlists/rockyou.txt ssh://10.10.10.10
hydra -U admin -L rockyou.txt 10.10.10.10:22

Correct answer: hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.10 ssh

The correct syntax uses -l for a single username, -P for a password list file, followed by the target IP and service name.

Question 55: What is the purpose of the 'rpcinfo -p <target>' command during enumeration?

Scan all open UDP ports
List all running processes on the target
Perform a remote password reset via RPC
Enumerate all RPC services and their port numbers on the target (Correct answer)

Correct answer: Enumerate all RPC services and their port numbers on the target

The 'rpcinfo -p' command queries the portmapper and lists all registered RPC programs, their versions, protocol, and the ports they are listening on.

Question 56: In Kali Linux, what is the primary use of the 'sslstrip' tool during a man-in-the-middle attack?

Decrypts SSL traffic using stolen private keys
Downgrades HTTPS connections to HTTP to intercept credentials in cleartext (Correct answer)
Strips SSL certificates from a web server
Removes SSL pinning from Android APKs

Correct answer: Downgrades HTTPS connections to HTTP to intercept credentials in cleartext

sslstrip intercepts HTTP redirects to HTTPS and serves the victim plain HTTP, allowing credentials to be captured in cleartext before forwarding to the real HTTPS server.

Question 57: What Windows command lists all services and their start types, useful for identifying auto-start services to target?

wmic service list brief (Correct answer)
sc query type= all
tasklist /svc
net start /all

Correct answer: wmic service list brief

The 'wmic service list brief' command provides a concise list of all Windows services including their name, process ID, start mode, and status.

Question 58: In Kali Linux, which tool is used to perform hash identification when you have an unknown hash and need to determine its algorithm?

hashcat --identify
hashtype
john --identify
hash-identifier (Correct answer)

Correct answer: hash-identifier

hash-identifier analyzes the structure and length of a hash string to identify the most likely hashing algorithm used.

Question 59: What does the command 'updatedb' do in Kali Linux and why is it relevant to OSCP engagements?

Synchronizes NTP time database
Updates the Metasploit database
Updates the APT database
Rebuilds the locate command's file index database (Correct answer)

Correct answer: Rebuilds the locate command's file index database

updatedb rebuilds the database used by the locate command, enabling fast file searches which is useful for quickly finding exploit scripts or config files.

Question 60: Which Kali Linux meta-package installs the top 10 most popular penetration testing tools?

kali-linux-default
kali-linux-full
kali-tools-top10 (Correct answer)
kali-linux-large

Correct answer: kali-tools-top10

The kali-tools-top10 meta-package installs the 10 most widely used tools included in Kali's curated top-10 list.

Question 61: What tool would you use to brute-force directory and file names on a web server during OSCP?

gobuster (Correct answer)
bloodhound
responder
enum4linux

Correct answer: gobuster

Gobuster is a tool used to brute-force URIs (directories and files), DNS subdomains, and virtual host names using wordlists.

Question 62: What are NTLMv2 challenge-response hashes and how are they typically cracked in OSCP?

They are base64-encoded and can be decoded directly
They require a live connection to crack via pass-the-hash
They are captured during authentication challenges (via Responder) and cracked offline with hashcat using module 5600 (Correct answer)
They are stored in the SAM database and cracked with secretsdump.py

Correct answer: They are captured during authentication challenges (via Responder) and cracked offline with hashcat using module 5600

NTLMv2 hashes are challenge-response authentication tokens captured from network traffic or via tools like Responder, and are cracked offline using hashcat module 5600 (NetNTLMv2).

Question 63: Linux file system that is virtualized and gives you access to the kernel's perspective

/dev
/sbin
/var
/proc (Correct answer)

Correct answer: /proc

The `/proc` file system in Linux is a virtual file system that provides a dynamic interface to the kernel's internal data structures and processes. It doesn't contain traditional files but rather real-time system information, including details about running processes, kernel parameters, and hardware. This allows users and programs to access the kernel's perspective and monitor system status.

Question 64: What does the 'accesschk.exe' tool from Sysinternals help identify during Windows privilege escalation?

Permissions on files, registry keys, services, and other objects (Correct answer)
All user accounts and their password policies
Active network connections and their processes
Scheduled tasks and their execution history

Correct answer: Permissions on files, registry keys, services, and other objects

Accesschk.exe audits permissions on Windows objects (files, services, registry, kernel objects), making it essential for finding world-writable services, files, or registry keys.

Question 65: Which tool is commonly used in OSCP labs to automate SQL injection discovery and exploitation?

Nikto
Hydra
Gobuster
SQLmap (Correct answer)

Correct answer: SQLmap

SQLmap is an open-source tool that automates detection and exploitation of SQL injection flaws, widely used during OSCP penetration tests.

Question 66: In Kali Linux, what does running 'chmod 600 id_rsa' before using a private SSH key accomplish?

Allows any user to read the key
Encrypts the key file with a passphrase
Sets the key permissions to owner-read-only, which SSH requires to prevent insecure key usage (Correct answer)
Makes the key executable

Correct answer: Sets the key permissions to owner-read-only, which SSH requires to prevent insecure key usage

SSH refuses to use private key files with overly permissive permissions; chmod 600 restricts the key to owner-readable only, satisfying SSH's security requirement.

Question 67: What does the SLEEP() function in a SQL injection payload help an attacker determine?

The number of columns in a query
Whether the injection point exists via time delay (Correct answer)
The table names in the database
The database version

Correct answer: Whether the injection point exists via time delay

SLEEP() is used in time-based blind SQLi to confirm a vulnerable injection point by causing a measurable delay in the server's response.

Question 68: Let's say a search field in an application can only hold 200 words; if you type in more and click the search button, the system would crash. Usually, this results from _____.

Buffer (Correct answer)
Processing power
Local storage
External storage

Correct answer: Buffer

The scenario described, where typing too much into a search field causes a system crash, is a classic symptom of a buffer overflow. The application likely allocates a fixed-size buffer to store the input, and exceeding this limit causes data to spill into adjacent memory. This corruption of memory can lead to unexpected program behavior or a system crash, indicating a lack of proper input validation or boundary checks.

Question 69: What Kali Linux tool would you use to perform ARP spoofing to intercept traffic between two hosts on a local network?

Both arpspoof and ettercap are correct (Correct answer)
arpspoof
tcpdump
ettercap

Correct answer: Both arpspoof and ettercap are correct

Both arpspoof (from dsniff suite) and ettercap can perform ARP spoofing attacks to position a Kali machine as a man-in-the-middle.

Question 70: When a Windows service runs as LocalSystem and you can restart it, what privilege escalation outcome is possible?

You can elevate to Domain Admin remotely
You gain read access to all files but not execute
You can execute arbitrary code as SYSTEM if you can modify the service binary or configuration (Correct answer)
You can only view system logs with elevated privileges

Correct answer: You can execute arbitrary code as SYSTEM if you can modify the service binary or configuration

If you can modify a service binary or its configuration and the service runs as LocalSystem (SYSTEM), restarting the service executes your payload with full SYSTEM privileges.

Question 71: Mike wants to replicate his files, but he also doesn't want them to be overwritten. What instruction should he issue?

cp -i (Correct answer)
cp
cp -a
cp -m

Correct answer: cp -i

The `cp` command is used to copy files and directories. The `-i` option stands for 'interactive', which prompts the user for confirmation before overwriting an existing file. This ensures that Mike's files will not be overwritten without his explicit consent, fulfilling his requirement to replicate files without overwriting them.

Question 72: Which Nmap scan type sends TCP SYN packets and is often called a 'half-open' scan?

-sU (UDP scan)
-sT (TCP connect scan)
-sS (SYN scan) (Correct answer)
-sA (ACK scan)

Correct answer: -sS (SYN scan)

The -sS SYN scan sends a SYN packet and listens for a SYN-ACK without completing the three-way handshake, making it stealthier than a full connect scan.

Question 73: What procedure deletes a folder?

delete
rmdir (Correct answer)
delete
mkdir

Correct answer: rmdir

The `rmdir` command is specifically designed to remove empty directories (folders) in Unix-like operating systems. If a directory contains any files or subdirectories, `rmdir` will fail and report an error. To delete non-empty directories, a different command like `rm -r` is typically used.

Question 74: In a Local File Inclusion (LFI) vulnerability, which of the following payloads is used to traverse directories and read /etc/passwd?

SELECT /etc/passwd
;cat /etc/passwd
<?php include('/etc/passwd'); ?>
../../../etc/passwd (Correct answer)

Correct answer: ../../../etc/passwd

Path traversal sequences (../) are used in LFI to navigate up the directory tree and access files outside the web root such as /etc/passwd.

Question 75: What is John the Ripper's primary use case versus hashcat in an OSCP context?

John handles only Linux hashes; hashcat handles only Windows hashes
John supports more protocols; hashcat only supports common algorithms
John cracks passwords online; hashcat only works offline
John is CPU-based and good for auto-detecting hash types; hashcat is GPU-accelerated and faster for bulk cracking (Correct answer)

Correct answer: John is CPU-based and good for auto-detecting hash types; hashcat is GPU-accelerated and faster for bulk cracking

John the Ripper auto-detects hash formats and is CPU-based making it versatile for quick analysis, while hashcat leverages GPU acceleration for much faster bulk password cracking.

Question 76: What Nmap script can identify anonymous FTP login on a target?

--script=ftp-anon (Correct answer)
--script=ftp-vsftpd-backdoor
--script=ftp-brute
--script=ftp-bounce

Correct answer: --script=ftp-anon

The ftp-anon script checks if an FTP server allows anonymous logins, which can be a significant misconfiguration exposing files without authentication.

OSCP - Offensive Security Certified Professional

The OSCP (PEN-200) is a hands-on penetration testing certification by OffSec requiring candidates to compromise target machines in a 23h45m practical exam worth 100 points. This practice test covers the core knowledge domains underlying the PEN-200 curriculum.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

help.offsec.com — Test delivery, score release, eligibility, retake fee, renewal, test dates, retake policy · verified Nov 2026
offsec.com — Score validity, exam format · verified Oct 2026