OSCP Exam Prep 2026/2027 | Active Directory, Privilege
Escalation, Enumeration & Penetration Testing
Section 1: Penetration Testing Methodology & Scoping
1. What is the primary purpose of defining the scope of a penetration
test?
A. To guarantee exploitation of every vulnerability
B. To identify which systems and activities are authorized
C. To determine the client's preferred operating system
D. To eliminate the need for documentation
Answer: B
Explanation: Scope defines the systems, networks, applications, time
windows, and activities that the tester is authorized to assess.
2. Which activity should normally occur before exploitation?
A. Reporting
B. Enumeration and validation
C. Data destruction
D. Persistence installation
Answer: B
Explanation: Enumeration provides information needed to understand
attack surfaces and select appropriate testing approaches.
3. What is the main difference between vulnerability scanning and
penetration testing?
,A. Scanning always requires credentials
B. Penetration testing attempts to validate security impact through
controlled exploitation
C. Penetration testing never uses automated tools
D. Vulnerability scanning is always manual
Answer: B
Explanation: A penetration test goes beyond identifying potential
weaknesses by validating whether vulnerabilities can actually be
exploited within scope.
4. Why should a penetration tester maintain notes during an
engagement?
A. Only for billing
B. To reconstruct the attack path and support the final report
C. To replace evidence collection
D. To avoid documenting commands
Answer: B
Explanation: Detailed notes help reproduce findings, troubleshoot
failed attempts, and produce accurate evidence and remediation
guidance.
5. What does the principle of least privilege mean?
A. Users should have administrator rights
B. Users receive only the access necessary for their responsibilities
C. Every service should run as root
D. Network traffic should be unrestricted
,Answer: B
Explanation: Least privilege limits the potential impact of compromised
accounts and applications.
6. What is a rules-of-engagement document used for?
A. Defining authorized testing procedures and constraints
B. Installing antivirus software
C. Generating passwords
D. Replacing vulnerability scanners
Answer: A
Explanation: Rules of engagement establish how, when, and where
testing may occur and identify prohibited activities.
7. What is a false positive?
A. A confirmed vulnerability
B. A reported issue that is not actually exploitable or present
C. A successful privilege escalation
D. A valid credential
Answer: B
Explanation: False positives occur when a tool or tester identifies a
condition that does not represent a genuine security weakness.
8. What is the primary purpose of validating a vulnerability manually?
A. To increase scan duration
B. To determine whether the finding is genuine and understand its
impact
C. To delete logs
D. To disable security controls permanently
, Answer: B
Explanation: Manual validation confirms whether a suspected
vulnerability is real and provides context that automated tools may
miss.
9. What should a tester do if an action falls outside the authorized
scope?
A. Perform it anyway
B. Stop and obtain appropriate authorization
C. Hide the activity
D. Ask another tester to perform it secretly
Answer: B
Explanation: Testing outside the agreed scope can create legal,
operational, and safety issues.
10. What is attack-surface reduction?
A. Increasing exposed services
B. Removing or restricting unnecessary entry points
C. Adding additional administrator accounts
D. Disabling authentication
Answer: B
Explanation: Reducing unnecessary services, ports, applications, and
privileges decreases opportunities for compromise.
11. Which phase generally involves identifying systems and services?
A. Enumeration
B. Reporting
Escalation, Enumeration & Penetration Testing
Section 1: Penetration Testing Methodology & Scoping
1. What is the primary purpose of defining the scope of a penetration
test?
A. To guarantee exploitation of every vulnerability
B. To identify which systems and activities are authorized
C. To determine the client's preferred operating system
D. To eliminate the need for documentation
Answer: B
Explanation: Scope defines the systems, networks, applications, time
windows, and activities that the tester is authorized to assess.
2. Which activity should normally occur before exploitation?
A. Reporting
B. Enumeration and validation
C. Data destruction
D. Persistence installation
Answer: B
Explanation: Enumeration provides information needed to understand
attack surfaces and select appropriate testing approaches.
3. What is the main difference between vulnerability scanning and
penetration testing?
,A. Scanning always requires credentials
B. Penetration testing attempts to validate security impact through
controlled exploitation
C. Penetration testing never uses automated tools
D. Vulnerability scanning is always manual
Answer: B
Explanation: A penetration test goes beyond identifying potential
weaknesses by validating whether vulnerabilities can actually be
exploited within scope.
4. Why should a penetration tester maintain notes during an
engagement?
A. Only for billing
B. To reconstruct the attack path and support the final report
C. To replace evidence collection
D. To avoid documenting commands
Answer: B
Explanation: Detailed notes help reproduce findings, troubleshoot
failed attempts, and produce accurate evidence and remediation
guidance.
5. What does the principle of least privilege mean?
A. Users should have administrator rights
B. Users receive only the access necessary for their responsibilities
C. Every service should run as root
D. Network traffic should be unrestricted
,Answer: B
Explanation: Least privilege limits the potential impact of compromised
accounts and applications.
6. What is a rules-of-engagement document used for?
A. Defining authorized testing procedures and constraints
B. Installing antivirus software
C. Generating passwords
D. Replacing vulnerability scanners
Answer: A
Explanation: Rules of engagement establish how, when, and where
testing may occur and identify prohibited activities.
7. What is a false positive?
A. A confirmed vulnerability
B. A reported issue that is not actually exploitable or present
C. A successful privilege escalation
D. A valid credential
Answer: B
Explanation: False positives occur when a tool or tester identifies a
condition that does not represent a genuine security weakness.
8. What is the primary purpose of validating a vulnerability manually?
A. To increase scan duration
B. To determine whether the finding is genuine and understand its
impact
C. To delete logs
D. To disable security controls permanently
, Answer: B
Explanation: Manual validation confirms whether a suspected
vulnerability is real and provides context that automated tools may
miss.
9. What should a tester do if an action falls outside the authorized
scope?
A. Perform it anyway
B. Stop and obtain appropriate authorization
C. Hide the activity
D. Ask another tester to perform it secretly
Answer: B
Explanation: Testing outside the agreed scope can create legal,
operational, and safety issues.
10. What is attack-surface reduction?
A. Increasing exposed services
B. Removing or restricting unnecessary entry points
C. Adding additional administrator accounts
D. Disabling authentication
Answer: B
Explanation: Reducing unnecessary services, ports, applications, and
privileges decreases opportunities for compromise.
11. Which phase generally involves identifying systems and services?
A. Enumeration
B. Reporting
