I85PREP
⌘ K
OSCP study materials
OSCP study resources

OSCP practice questions

One question at a time. Build your OSCP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Gathering and Enumeration

Which DNS record type, if permitted to any requesting client, lets an attacker retrieve every record in a zone in a single request?

  1. AXFR Correct answer.
  2. PTR
  3. MX
  4. CNAME

Explanation

A zone transfer (AXFR) returns the complete contents of a DNS zone to any client the nameserver allows, exposing internal hostnames, mail servers, and third-party records. Restricting transfers to authorized secondary nameservers is the standard mitigation.

Question 2Information Gathering and Enumeration

Which transport and port does the WHOIS service use by default?

  1. TCP 25
  2. TCP 389
  3. TCP 43 Correct answer.
  4. UDP 53

Explanation

WHOIS queries are served over TCP port 43 by registrars and regional internet registries, returning registration dates, contacts, and authoritative nameservers for a domain or IP range.

Question 3Information Gathering and Enumeration

Which file at a website's root lists paths that crawlers are asked to skip and often hints at administrative or backup directories?

  1. robots.txt Correct answer.
  2. crossdomain.xml
  3. sitemap.xml
  4. security.txt

Explanation

robots.txt is fetched from the site root and contains Disallow entries for crawlers; those entries frequently name administrative panels, staging folders, and backup files worth testing.

Question 4Information Gathering and Enumeration

Which DNS record type stores the IPv6 address of a host?

  1. AAAA Correct answer.
  2. TXT
  3. MX
  4. A

Explanation

An AAAA record maps a hostname to a 128-bit IPv6 address, in the same way an A record maps a hostname to a 32-bit IPv4 address. Enumerating AAAA records can reveal IPv6-only services that host-based filtering fails to cover.

Question 5Information Gathering and Enumeration

Which nmap option enables UDP port scanning?

  1. -sN
  2. -sU Correct answer.
  3. -sA
  4. -sT

Explanation

The -sU option sends UDP datagrams to each targeted port and interprets ICMP port-unreachable replies as closed ports. Because open UDP services often return nothing at all, results are slow and require corroboration.

Question 6Information Gathering and Enumeration

Which TCP port does SMB use when it runs directly over TCP without NetBIOS session service?

  1. 445 Correct answer.
  2. 139
  3. 137
  4. 135

Explanation

Direct-hosted SMB listens on TCP 445, while TCP 139 carries SMB encapsulated in a NetBIOS session. Modern Windows systems typically expose 445 and can be enumerated there for shares, users, and OS details.

Question 7Information Gathering and Enumeration

Which SMTP command asks the server whether a given mailbox exists and can leak valid usernames when left enabled?

  1. VRFY Correct answer.
  2. EHLO
  3. HELO
  4. MAIL FROM

Explanation

VRFY asks the mail server to confirm a mailbox name, and older or misconfigured servers answer with a different code for valid and invalid users. Disabling VRFY and EXPN is the usual hardening step.

Question 8Information Gathering and Enumeration

Which command performs a reverse DNS lookup of the address 10.10.10.5?

  1. host -t A 10.10.10.5
  2. dig 10.10.10.5 PTR
  3. dig -x 10.10.10.5 Correct answer.
  4. nslookup 10.10.10.5 A

Explanation

The -x flag tells dig to reverse the address into an in-addr.arpa name and query its PTR record. This is useful during enumeration because internal PTR records often reveal naming conventions and host roles.

Question 9Information Gathering and Enumeration

An assessor needs to determine which services and version numbers are answering on discovered open ports. Which nmap option answers this requirement?

  1. Sets the timing template
  2. Runs all default NSE scripts
  3. Enables OS detection
  4. -sV Correct answer.

Explanation

Version detection probes each open port with service-specific payloads and matches the replies against a signature database, placing the product and version in the port table.

Question 10Information Gathering and Enumeration

Which tool extracts users, groups, shares, and password policy from a Windows host over SMB and RPC?

  1. theHarvester
  2. wafw00f
  3. nikto
  4. enum4linux Correct answer.

Explanation

enum4linux wraps tools such as rpcclient, net, and nmblookup to run a broad set of SMB and RPC queries against a Windows host. It commonly reveals share listings, local users and groups, and the password policy when a null or guest session is permitted.

Question 11Information Gathering and Enumeration

Which community string is the widely shipped default read-only value on SNMP v1 and v2c devices?

  1. cisco
  2. readonly
  3. public Correct answer.
  4. private

Explanation

Many devices ship with the read-only community string 'public' and the read-write string 'private', both sent in cleartext. A valid community string allows an attacker to read interface, routing, process, and sometimes user data from the device.

Question 12Information Gathering and Enumeration

Which TCP port carries unencrypted LDAP queries?

  1. 3268
  2. 636
  3. 88
  4. 389 Correct answer.

Explanation

Plain LDAP listens on TCP 389, and its TLS-protected counterpart on TCP 636. Anonymous or weakly bound queries against 389 can return directory objects such as users and group memberships.

Question 13Information Gathering and Enumeration

Which command lists the NFS exports that a remote host is offering?

  1. showmount -e 10.10.10.5 Correct answer.
  2. nfsstat -s 10.10.10.5
  3. rpcclient -U '' 10.10.10.5
  4. smbclient -L 10.10.10.5

Explanation

showmount -e queries the remote mount daemon and prints each exported path with its allowed client list. Exports permitted to a wildcard or to the attacker's subnet can often be mounted directly and read.

Question 14Information Gathering and Enumeration

Which public data source frequently reveals subdomains of a target because issued certificates are published and searchable?

  1. SPF TXT records
  2. robots.txt disallow rules
  3. CT logs Correct answer.
  4. WHOIS registrant records

Explanation

Every publicly trusted certificate is submitted to certificate transparency logs, and those logs can be searched by domain to list names that were certified. Historically this surfaces internal, staging, and forgotten subdomains that never appear in DNS brute-force results.

Question 15Information Gathering and Enumeration

Which search operator restricts results to pages belonging to a single domain?

  1. inurl:
  2. intitle:
  3. site: Correct answer.
  4. filetype:

Explanation

The site: operator limits a search to one domain or subdomain, so pairing it with keywords can expose indexed admin panels, documents, and error pages. Combining it with filetype: narrows results to specific document types.

Question 16Information Gathering and Enumeration

Which command opens a raw TCP connection to port 22 on 10.10.10.5 so the service greeting can be read?

  1. nc -nv 10.10.10.5 22 Correct answer.
  2. ping -p 22 10.10.10.5
  3. nmap -sU 10.10.10.5
  4. curl -X 22 10.10.10.5

Explanation

Netcat with -n and -v avoids name resolution, reports connection status, and prints whatever the remote service sends first. SSH, SMTP, FTP, and similar services announce their product and version in that initial banner.

Question 17Information Gathering and Enumeration

Which service indexes internet-facing hosts and their exposed services so they can be searched by banner, port, or product?

  1. Maltego
  2. Wappalyzer
  3. Shodan Correct answer.
  4. theHarvester

Explanation

Shodan continuously scans the public internet and stores the responses, allowing queries by port, product, certificate, or banner text. It gives reconnaissance over a target's external footprint without sending traffic from the assessor's own address.

Question 18Information Gathering and Enumeration

Which gobuster mode brute-forces subdomain names against a target domain?

  1. fuzz
  2. dir
  3. vhost
  4. dns Correct answer.

Explanation

The dns mode takes a domain and a wordlist, prepends each word to the domain, and reports which names resolve. The vhost mode instead holds DNS fixed and varies the Host header against a single IP address.

Question 19Information Gathering and Enumeration

An assessor sends requests to a single IP address with different Host headers and receives clearly different page content for each name. What does this indicate?

  1. Named virtual hosts exist Correct answer.
  2. HTTP/2 multiplexing is active
  3. Only a load balancer is present
  4. Wildcard DNS is misconfigured

Explanation

A server that returns distinct content based on the Host header is serving name-based virtual hosts from one address. Each discovered name must be enumerated separately, since an application hidden on a vhost may never be reachable through the default site.

Question 20Information Gathering and Enumeration

Which command attempts a zone transfer of example.com from the nameserver ns1.example.com?

  1. dig example.com AXFR +ns1
  2. nslookup -type=AXFR example.com ns1.example.com
  3. host -l example.com 10.0.0.1
  4. dig axfr example.com @ns1.example.com Correct answer.

Explanation

The @ prefix selects the nameserver to query, and the axfr type requests a full zone transfer. The server replies with the entire zone only if its access controls permit the requesting address.

Question 21Information Gathering and Enumeration

A domain publishes the TXT record "v=spf1 include:_spf.google.com -all". What does this tell an assessor about the domain's mail?

  1. Any host may send mail on its behalf
  2. The domain runs no mail infrastructure
  3. Authorized senders are limited to Google Correct answer.
  4. DNSSEC validation is enforced for the zone

Explanation

The include mechanism imports the sending hosts authorized by another domain's SPF policy, and the -all qualifier tells receivers to reject everything not matched. Reconnaissance can therefore conclude that the organization's outbound mail is handled by that third-party provider.

Question 22Information Gathering and Enumeration

An assessor's nmap host-discovery step reports that a target is down, yet the host clearly serves a website. Which adjustment is most likely to produce usable scan results?

  1. Add -sU to include UDP ports
  2. Add -T0 to reduce scan speed
  3. Add -Pn to skip host discovery Correct answer.
  4. Add --reason to explain port states

Explanation

When ICMP echo and other discovery probes are filtered, nmap concludes the host is down and skips the port scan entirely. The -Pn option treats every target as online and scans its ports directly, bypassing the faulty liveness check.

Question 23Vulnerability Scanning and Analysis

An assessor runs `nmap -sV 10.10.10.5` against a target. What does this option add to a default port scan?

  1. It probes open ports to identify service versions. Correct answer.
  2. It enables the Nmap Scripting Engine default category.
  3. It scans all 65535 TCP ports.
  4. It performs OS fingerprinting against the target.

Explanation

Service detection sends probes to open ports and compares the replies against a signature database to report the product and version. It is distinct from OS fingerprinting, which targets the host's IP stack, and from the port selection options.

Question 24Vulnerability Scanning and Analysis

Which Nmap option performs host discovery only, without scanning any ports on the target?

  1. -sn Correct answer.
  2. -Pn
  3. -sS
  4. -sU

Explanation

The -sn option runs the ping scan, sending discovery probes and reporting live hosts without proceeding to port scanning. It replaced the older -sP option and is the standard way to map a network before scanning.

Question 25Vulnerability Scanning and Analysis

What does an identifier such as CVE-2021-44228 represent?

  1. A category of software weakness maintained by MITRE.
  2. A scoring metric for the severity of a flaw.
  3. A vendor patch number assigned by Microsoft.
  4. A publicly disclosed vulnerability tracked in a catalog. Correct answer.

Explanation

CVE is a catalog of publicly disclosed vulnerabilities, each assigned a unique identifier so tools and vendors can refer to the same issue. Severity scoring is handled by CVSS, and weakness categories are handled by CWE.

Question 26Vulnerability Scanning and Analysis

Nikto is primarily used to do which of the following?

  1. Brute force user credentials on a remote SSH daemon.
  2. Find risky files and misconfigs on a web server. Correct answer.
  3. Enumerate shared folders exposed over SMB.
  4. Fingerprint the operating system of a remote host.

Explanation

Nikto is a web server scanner that requests known dangerous files, checks for outdated server software, and reports misconfigurations. It does not perform credential brute forcing or SMB enumeration.

Question 27Vulnerability Scanning and Analysis

What is the numeric range of a CVSS base score?

  1. 1.0 to 5.0
  2. 0.0 to 10.0 Correct answer.
  3. 0 to 100
  4. 1 to 10, whole numbers only

Explanation

CVSS base scores run from 0.0 to 10.0 and permit one decimal place, with 10.0 representing the most severe rating. The score is derived from exploitability and impact metrics rather than assigned arbitrarily.

Question 28Vulnerability Scanning and Analysis

An assessor has a local copy of Exploit-DB and wants to search it offline from the command line. Which tool is designed for this?

  1. msfvenom
  2. enum4linux
  3. searchsploit Correct answer.
  4. nikto

Explanation

searchsploit queries the locally installed Exploit-DB copy and prints matching exploits with their paths, so it works without internet access. It is a search utility and does not itself launch exploits.

Question 29Vulnerability Scanning and Analysis

Which Nmap argument scans every TCP port on the target?

  1. -F
  2. --top-ports 100
  3. -p- Correct answer.
  4. -r

Explanation

The -p- argument is shorthand for the full range 1-65535, so every TCP port is probed. The other options either restrict the port list or change the scan order.

Question 30Vulnerability Scanning and Analysis

Why does an Nmap `-sS` scan generally require root privileges on Linux?

  1. It opens a full TCP connection that only the root user may create.
  2. It depends on the kernel's routing table, which is root-only.
  3. It must modify the target's firewall rules to receive replies.
  4. It crafts raw packets, which requires raw socket access. Correct answer.

Explanation

A SYN scan builds TCP packets itself and sends them through a raw socket, which is a privileged operation on most Unix-like systems. It never completes the handshake, so it is described as a half-open scan.

Question 31Vulnerability Scanning and Analysis

During an Nmap UDP scan, a target replies with an ICMP port unreachable message. What does this indicate about the probed port?

  1. The host is down.
  2. The UDP port is closed. Correct answer.
  3. The port is filtered by a firewall.
  4. The UDP port is open.

Explanation

An ICMP port unreachable message means no process is bound to that UDP port, so Nmap records it as closed. Ports that return no reply at all are usually reported as open or filtered.

Question 32Vulnerability Scanning and Analysis

What is a primary benefit of running a vulnerability scan with valid credentials?

  1. It avoids sending any traffic to the target network.
  2. It reads local patch and config data, reducing false positives. Correct answer.
  3. It removes the need to review findings manually before reporting.
  4. It guarantees that every vulnerability on the host will be found.

Explanation

Authenticated scans log in and inspect installed packages, registry keys, and configuration files directly, so findings are based on local evidence rather than remote inference. This both lowers false positives and exposes missing patches that a network-only check would miss.

Question 33Vulnerability Scanning and Analysis

In Nmap, what does the `-sC` option do?

  1. Loads a custom script from a file path.
  2. Runs the scripts in the default category. Correct answer.
  3. Disables all NSE scripts during the scan.
  4. Runs the scripts in the 'intrusive' category only.

Explanation

-sC is shorthand for --script=default and launches the default category of NSE scripts, which are considered safe for general scanning. Other categories and individual scripts must be named explicitly.

Question 34Vulnerability Scanning and Analysis

Why can OS detection with `-O` fail when no open or closed TCP port is found?

  1. The kernel refuses to send packets to hosts without open ports.
  2. Nmap needs a privileged account to read the ARP cache.
  3. It needs replies from one open and one closed port. Correct answer.
  4. OS detection only works over UDP.

Explanation

Nmap builds an OS fingerprint from how the target's IP stack answers probes sent to both an open and a closed port. Without both, the fingerprint is incomplete and the guess is unreliable or omitted.

Question 35Vulnerability Scanning and Analysis

Which command uses Netcat to grab a service banner from port 22 on 10.10.10.5?

  1. nc -u 10.10.10.5 22
  2. nc -z 10.10.10.5 22
  3. nc 10.10.10.5 22 Correct answer.
  4. nc -l 10.10.10.5 22

Explanation

Supplying a host and port makes Netcat open a TCP connection and print whatever the service sends, which for SSH reveals the banner. The other flags change listening mode, scan mode, or transport protocol.

Question 36Vulnerability Scanning and Analysis

Which tool is designed to brute force web content such as hidden directories and files?

  1. hydra
  2. sqlmap
  3. tcpdump
  4. gobuster Correct answer.

Explanation

gobuster sends requests for names taken from a wordlist and reports the ones that return interesting status codes, revealing hidden paths. Similar tools include ffuf, dirb, and feroxbuster.

Question 37Vulnerability Scanning and Analysis

An assessor needs to enumerate the supported cipher suites and protocol versions on an HTTPS service. Which tool is built for this?

  1. Responder
  2. nmap -sn
  3. testssl.sh Correct answer.
  4. enum4linux

Explanation

testssl.sh systematically negotiates each protocol version and cipher suite against the endpoint and flags weak or deprecated options. sslscan and similar utilities serve the same purpose.

Question 38Vulnerability Scanning and Analysis

A vulnerability scanner reports a flaw that does not actually exist on the target. How is this result classified?

  1. A true positive
  2. A false negative
  3. A compensating control
  4. A false positive Correct answer.

Explanation

A false positive is a reported finding that is not real, and it must be validated and dismissed before reporting. Its opposite, a false negative, is a real issue the scanner failed to report.

Question 39Vulnerability Scanning and Analysis

In Nessus, what determines which checks are performed against a target?

  1. The number of open ports found on the scanner host.
  2. The selected scan policy and plugin set. Correct answer.
  3. The length of the target hostname.
  4. The scanner's license expiration date.

Explanation

A scan policy bundles settings such as port range, credentials, and the enabled plugin families, and that plugin set defines the checks that run. Hostnames and license dates do not control which tests are launched.

Question 40Vulnerability Scanning and Analysis

Which Nmap option treats every target as online and skips host discovery?

  1. -sn
  2. -sA
  3. -O
  4. -Pn Correct answer.

Explanation

-Pn suppresses the discovery phase and assumes each specified target is up, which is useful when ICMP or discovery probes are filtered. It does not itself enable any port scanning technique.

Question 41Vulnerability Scanning and Analysis

When triaging vulnerability scanner output, which combination best prioritizes remediation?

  1. The number of open ports discovered on each host.
  2. Severity plus confirmed exploitability on the target. Correct answer.
  3. The date and time at which the scan was started.
  4. The alphabetical order of the plugin names in the report.

Explanation

Risk-based prioritisation combines a severity metric such as CVSS with evidence that the issue is real and reachable in the target's context. Confirming exploitability also filters out false positives before effort is assigned.

Question 42Vulnerability Scanning and Analysis

An assessor wants to learn whether a firewall is stateful or stateless. Which Nmap scan best supports this?

  1. -sA Correct answer.
  2. -sV
  3. -sT
  4. -sU

Explanation

An ACK scan sends unsolicited ACK packets and interprets RST replies as unfiltered and silence as filtered, which maps firewall rule sets and hints at whether connection state is tracked. The technique does not identify open ports.

Question 43Vulnerability Scanning and Analysis

A host is known to be vulnerable, but an unauthenticated scan from the assessor's segment reports nothing. Which explanation is most likely?

  1. A firewall dropped the probes used to check the service. Correct answer.
  2. The vulnerability has a high CVSS base score.
  3. The target was scanned with valid credentials.
  4. The scanner discovered far too many open ports on the host.

Explanation

A false negative commonly arises when filtering devices silently drop the probes the scanner needs, so the vulnerable service is never assessed. Verifying from another network position or checking firewall rules confirms the cause.

Question 44Vulnerability Scanning and Analysis

Which Nmap invocation runs NSE scripts from the 'vuln' category against a target?

  1. nmap -sS -p- 10.10.10.5
  2. nmap -sV -O 10.10.10.5
  3. nmap -sn --script=vuln 10.10.10.5
  4. nmap -sV --script=vuln 10.10.10.5 Correct answer.

Explanation

The --script option accepts category names, and vuln is the category containing scripts that check for known vulnerabilities. Pairing it with -sV gives the scripts version data they often depend on.

Question 45Web Application Attacks

An attacker submits the string `' OR '1'='1` into a login form and is authenticated without knowing any valid credentials. Which vulnerability does this demonstrate?

  1. SQL injection Correct answer.
  2. Command injection
  3. XPath injection
  4. LDAP injection

Explanation

The payload closes the quoted string in the query and adds a tautological condition, so the WHERE clause matches a row regardless of the password. That manipulation of query syntax through user input is SQL injection. The other techniques require a different interpreter or query language than the one being abused here.

Question 46Web Application Attacks

A search page writes the value of the `q` parameter directly into the HTML body of its response without any encoding. Which vulnerability does this most directly create?

  1. SQL injection
  2. Server-side request forgery via the q parameter
  3. Reflected cross-site scripting Correct answer.
  4. XML external entity injection

Explanation

When attacker-controlled input is echoed into a response unencoded, script supplied in the parameter executes in the victim's browser, which is reflected XSS. The payload is never placed in a query, fetched by the server, or parsed as XML.

Question 47Web Application Attacks

Which control most directly prevents an attacker's page from silently submitting a state-changing form on another site using a victim's session cookie?

  1. Setting the HttpOnly flag on the session cookie
  2. Escaping HTML entities in the response
  3. Disabling directory listing on the web server
  4. Requiring a per-session anti-CSRF token Correct answer.

Explanation

A per-session token that the attacker's page cannot read forces any forged request to fail validation, which defeats cross-site request forgery. Browsers still attach ambient cookies to cross-site requests, so cookie flags alone do not stop the attack.

Question 48Web Application Attacks

A download endpoint takes `?file=report.pdf` and returns the contents of `/etc/passwd` when `?file=../../../../etc/passwd` is supplied. Which vulnerability is present?

  1. Insecure direct object reference
  2. XML external entity injection
  3. Server-side request forgery
  4. Path traversal Correct answer.

Explanation

The application uses user input to build a filesystem path without constraining it to an intended directory, so dot-dot sequences escape the base folder. This is path (directory) traversal. The server is reading local files rather than fetching remote resources or reusing an object identifier with missing authorization checks.

Question 49Web Application Attacks

A web application builds the shell command `ping -c 1 <host>` from a user-supplied host value. Which input most reliably demonstrates operating system command injection?

  1. 127.0.0.1; id Correct answer.
  2. ' OR 1=1--
  3. ../../etc/passwd
  4. 127.0.0.1 &&&

Explanation

A semicolon terminates the intended `ping` command and starts a new one, so `id` runs in the same shell. This proves arbitrary command execution rather than merely malformed input.

Question 50Web Application Attacks

Which cookie attribute limits the impact of a cross-site scripting flaw by keeping the cookie out of reach of JavaScript?

  1. Secure
  2. HttpOnly Correct answer.
  3. Domain
  4. SameSite=Strict

Explanation

HttpOnly instructs the browser to hide the cookie from the document object model, so injected script cannot read it. It does not prevent the cookie from being sent with requests; it only blocks script access.