Offensive Security OSCP Practice Test

OSCP practice test: what's covered

• Penetration Testing with Kali (PEN-200)

Free OSCP sample questions

1. During a black-box engagement you run Nmap as root and want to map open TCP ports quickly without ever completing the three-way handshake. Which scan type does this?

   • A. -sT connect scan, which finishes the full TCP handshake on every port
   • B. -sS SYN scan, sending SYN and replying RST before the handshake completes
   • C. -sU UDP scan, which probes UDP services instead of TCP ports
   • D. -sN null scan, which sends packets with no TCP flags set at all
   Show answer

   Correct: B. The -sS SYN scan sends a SYN, reads the SYN-ACK to mark the port open, then sends RST so the handshake never finishes, making it fast and stealthy; it is Nmap's default for root. -sT is incorrect because it completes the full handshake and is noisier. -sU scans UDP, not TCP, whereas -sN is a null scan used for firewall evasion rather than the standard half-open technique.

2. A web server responds on port 8080 but you cannot tell which software or version is running. Which Nmap option fingerprints the service version on that port?

   • A. -sV to send probes that elicit and parse service banners and versions
   • B. -sP to perform a host-discovery ping sweep without any port scanning
   • C. -Pn to skip host discovery and treat the target as definitely online
   • D. -sn to disable port scanning and only check whether hosts are alive
   Show answer

   Correct: A. -sV runs Nmap's version-detection engine, sending probes and matching responses against the nmap-service-probes database to identify product and version. -sP (now -sn) only does host discovery and runs no port or version checks, so it cannot fingerprint the service. -Pn merely skips host discovery, and -sn is the modern ping-sweep flag, neither of which performs version detection.

3. You discover TCP 139/445 open on a Windows target and want to enumerate shares, users, and null sessions over SMB. Which tools are appropriate for this? (Choose THREE)

   • A. enum4linux to automate user, share, and policy enumeration over SMB
   • B. smbclient to list and connect to shares, including anonymous null sessions
   • C. crackmapexec to enumerate shares and validate credentials across SMB hosts
   • D. sqlmap to automatically detect and exploit SQL injection in web parameters
   • E. john to crack captured password hashes offline using wordlists and rules
   Show answer

   Correct: A and B and C. enum4linux, smbclient, and crackmapexec are all SMB-focused: they enumerate shares, users, password policy, and test null sessions on 139/445. sqlmap is incorrect because it targets web SQL injection, not SMB, whereas john is an offline hash cracker and does not interact with the SMB service at all, so neither belongs to SMB enumeration.

4. After finding a website you want to brute-force hidden directories and files using a wordlist. Which approach reflects standard OSCP web content discovery?

   • A. Run gobuster or ffuf against the URL with a SecLists directory wordlist
   • B. Run nikto once and accept its findings as a complete directory listing
   • C. Open the homepage in a browser and read the visible navigation menu only
   • D. Send a single curl request to the root path and inspect the response body
   Show answer

   Correct: A. gobuster and ffuf perform fast directory and file fuzzing using wordlists such as those from SecLists, which is the standard discovery method. Running nikto alone is incorrect because it scans for known issues rather than exhaustively brute-forcing paths. Reading only the navigation menu or a single curl response will not reveal unlinked or hidden content, so both miss the point of content discovery.

5. A misconfigured DNS server allows anyone to pull the entire zone. Which technique lets you download every record in that zone at once?

   • A. A DNS zone transfer (AXFR) requesting the full zone from the nameserver
   • B. A reverse PTR lookup of a single IP address to find its hostname only
   • C. An MX record query that returns just the domain's mail exchanger hosts
   • D. A TXT record query that returns only SPF and verification text strings
   Show answer

   Correct: A. An AXFR zone transfer asks the nameserver to replicate the complete zone, dumping all records when the server is misconfigured to allow it, often via dig axfr or dnsrecon. A reverse PTR lookup resolves a single IP, an MX query returns only mail servers, and a TXT query returns only text records; none of these retrieve the whole zone, so they are incorrect for full zone disclosure.

Last updated: 2026-10-19

OSCP practice test FAQ

Related practice tests

• Offensive Security OSDA practice test
• Offensive Security OSEP practice test
• Offensive Security OSWE practice test