Offensive Security OSEP Practice Test

OSEP practice test: what's covered

• Advanced evasion
• AV/EDR bypass
• AD attacks
• lateral movement

Free OSEP sample questions

1. A detection engineer wants the earliest possible signal when a PowerShell payload is decoded in memory. Which telemetry source inspects script content right before execution?

   • A. AMSI (Antimalware Scan Interface), which scans the deobfuscated buffer before the scripting host runs it
   • B. Windows Firewall connection logs for outbound TCP sessions to unknown hosts
   • C. The DNS resolver cache, which records every hostname the script attempts to resolve
   • D. The NTFS USN journal, which records file create and rename operations on disk
   Show answer

   Correct: A. AMSI is the choke point that submits the fully deobfuscated script (PowerShell, VBScript, JScript, .NET) to the registered AV provider before execution, so it sees the real payload even after layered obfuscation. The firewall and DNS cache only show network artifacts after execution, and the USN journal is irrelevant because in-memory loaders never touch disk, so those sources cannot catch the decode step.

2. After enabling PowerShell Script Block Logging, a SOC analyst sees Event ID 4104 containing a snippet that overwrites bytes at the start of AmsiScanBuffer. What is this activity?

   • A. An in-memory AMSI tampering attempt that should be alerted and investigated immediately
   • B. A routine Windows Update servicing operation that rewrites system DLLs safely
   • C. Normal behavior of the .NET garbage collector reclaiming unused managed memory
   • D. A benign certificate enrollment request handled by the local CA connector
   Show answer

   Correct: A. Patching the entry bytes of AmsiScanBuffer forces a clean result so later scripts are never scanned, and Script Block Logging captures the patch text itself, which is why 4104 is a high-value detection. It is not Windows Update or garbage collection because neither rewrites AMSI internals, and certificate enrollment touches the CA, not amsi.dll, so those answers are incorrect.

3. An adversary patches EtwEventWrite in ntdll to blind .NET runtime telemetry. As a detection engineer, which compensating controls help you keep visibility? (Choose TWO)

   • A. Ship kernel-mode ETW and EDR sensor events to a SIEM the host process cannot edit in user mode
   • B. Monitor for unexpected RWX or self-modification of ntdll image regions in protected processes
   • C. Disable all Windows event logging to reduce noise and speed up triage of the host
   • D. Rely solely on the local Application event log retained only on the affected endpoint
   • E. Trust user-mode ETW from the same process as the only required source of .NET activity
   Show answer

   Correct: A and B. Forwarding kernel-sourced telemetry off-host and watching for tampering with ntdll memory both survive a user-mode ETW patch because the attacker cannot reach those layers from the compromised process. Disabling logging and relying only on local logs destroy visibility, and trusting in-process user-mode ETW is exactly the source the patch defeats, so those options are wrong.

4. Your EDR relies on inline hooks placed in ntdll user-mode stubs. Adversaries evade it with direct syscalls. Which hardening best restores kernel-level visibility?

   • A. Enable kernel callbacks (PsSetCreateProcessNotifyRoutine and ETW Threat Intelligence) that observe below user-mode hooks
   • B. Increase the polling interval of the user-mode agent so it samples ntdll more often
   • C. Block all inbound SMB traffic at the host firewall to stop remote code delivery
   • D. Force every process to run with administrative privileges for fuller logging
   Show answer

   Correct: A. Direct syscalls jump straight into the kernel, bypassing user-mode ntdll hooks, so visibility must move to kernel callbacks and ETW-TI which see the syscall regardless of user-mode tampering. Polling user-mode stubs still misses the bypass, blocking SMB does not address local syscall evasion, and forcing admin rights weakens security rather than restoring telemetry, so those are incorrect.

5. A threat hunter wants to distinguish direct from indirect syscalls during evasion triage. Which artifact most reliably separates the two techniques?

   • A. The call stack: indirect syscalls return into legitimate ntdll bytes, while direct syscalls show only attacker-module frames
   • B. The amount of physical RAM installed on the endpoint at the time of execution
   • C. The user's display language setting configured in the regional control panel
   • D. The number of CPU cores reported by the system to the scheduling subsystem
   Show answer

   Correct: A. Call-stack analysis is the differentiator because indirect syscalls trampoline through clean ntdll so the stack looks normal, whereas a direct inline syscall leaves a stack with no ntdll frame, a strong anomaly. RAM, language, and core count have no relationship to syscall provenance, so they cannot be used to tell the techniques apart and are incorrect.

Last updated: 2026-10-19

OSEP practice test FAQ

Related practice tests

• Offensive Security OSCP practice test
• Offensive Security OSDA practice test
• Offensive Security OSWE practice test