Offensive Security Certified Professional (OSCP) Exam
2026/2027 | Complete Practice Test, Answers & Explanations
Section 1: Penetration Testing Fundamentals
1. What is the primary purpose of reconnaissance?
A. Delete system logs
B. Gather information about the target
C. Install persistence
D. Encrypt files
Answer: B
Explanation: Reconnaissance identifies useful information about a
target before exploitation.
2. Which activity is considered passive reconnaissance?
A. Port scanning a server
B. Banner grabbing
C. Reviewing publicly available information
D. Testing authentication
Answer: C
Explanation: Passive reconnaissance gathers information without
directly interacting with the target system.
3. What is enumeration?
A. Removing vulnerabilities
B. Extracting detailed information from discovered services
C. Encrypting traffic
D. Creating backups
Answer: B
,Explanation: Enumeration investigates discovered services to identify
users, shares, versions, directories, and other useful information.
4. What is the primary objective of vulnerability assessment?
A. Identify security weaknesses
B. Destroy vulnerable hosts
C. Modify production data
D. Disable monitoring
Answer: A
Explanation: Vulnerability assessment identifies weaknesses that could
potentially be exploited.
5. Which principle should guide authorized penetration testing?
A. Minimize unnecessary impact
B. Avoid documentation
C. Modify systems permanently
D. Disable all security controls
Answer: A
Explanation: Professional penetration testing should minimize
operational impact while demonstrating security weaknesses.
6. What does attack surface mean?
A. Physical size of a network
B. Collection of potential entry points
C. Number of administrators
D. Amount of disk space
Answer: B
Explanation: The attack surface consists of systems, services,
applications, interfaces, and other potential avenues of attack.
,7. What is a scope document used for?
A. Defining authorized testing boundaries
B. Storing passwords
C. Installing software
D. Configuring DNS
Answer: A
Explanation: Scope establishes which systems, networks, techniques,
and time periods are authorized for testing.
8. Why should penetration testers document findings?
A. To increase attack speed
B. To support reproducibility and reporting
C. To hide evidence
D. To bypass authorization
Answer: B
Explanation: Documentation allows findings to be reproduced,
validated, communicated, and remediated.
9. What is a false positive?
A. A real vulnerability missed by testing
B. A reported issue that is not actually present
C. A successful exploit
D. A compromised administrator account
Answer: B
Explanation: A false positive occurs when testing incorrectly identifies a
vulnerability.
10. What is a false negative?
A. A vulnerability incorrectly reported
B. A real vulnerability that testing fails to identify
, C. A valid credential
D. A confirmed service
Answer: B
Explanation: False negatives are dangerous because genuine
weaknesses remain undiscovered.
11. Which approach generally provides the most information about a
target?
A. Black-box
B. White-box
C. Blind testing
D. Passive-only testing
Answer: B
Explanation: White-box testing provides substantial internal
information such as source code, architecture, or credentials.
12. What characterizes black-box testing?
A. Full source-code access
B. Minimal prior information
C. Administrator access
D. Complete network diagrams
Answer: B
Explanation: Black-box testing simulates an attacker with little or no
internal knowledge.
13. What is gray-box testing?
A. Testing without authorization
B. Testing with limited internal knowledge
C. Testing only physical security
D. Testing only encryption
2026/2027 | Complete Practice Test, Answers & Explanations
Section 1: Penetration Testing Fundamentals
1. What is the primary purpose of reconnaissance?
A. Delete system logs
B. Gather information about the target
C. Install persistence
D. Encrypt files
Answer: B
Explanation: Reconnaissance identifies useful information about a
target before exploitation.
2. Which activity is considered passive reconnaissance?
A. Port scanning a server
B. Banner grabbing
C. Reviewing publicly available information
D. Testing authentication
Answer: C
Explanation: Passive reconnaissance gathers information without
directly interacting with the target system.
3. What is enumeration?
A. Removing vulnerabilities
B. Extracting detailed information from discovered services
C. Encrypting traffic
D. Creating backups
Answer: B
,Explanation: Enumeration investigates discovered services to identify
users, shares, versions, directories, and other useful information.
4. What is the primary objective of vulnerability assessment?
A. Identify security weaknesses
B. Destroy vulnerable hosts
C. Modify production data
D. Disable monitoring
Answer: A
Explanation: Vulnerability assessment identifies weaknesses that could
potentially be exploited.
5. Which principle should guide authorized penetration testing?
A. Minimize unnecessary impact
B. Avoid documentation
C. Modify systems permanently
D. Disable all security controls
Answer: A
Explanation: Professional penetration testing should minimize
operational impact while demonstrating security weaknesses.
6. What does attack surface mean?
A. Physical size of a network
B. Collection of potential entry points
C. Number of administrators
D. Amount of disk space
Answer: B
Explanation: The attack surface consists of systems, services,
applications, interfaces, and other potential avenues of attack.
,7. What is a scope document used for?
A. Defining authorized testing boundaries
B. Storing passwords
C. Installing software
D. Configuring DNS
Answer: A
Explanation: Scope establishes which systems, networks, techniques,
and time periods are authorized for testing.
8. Why should penetration testers document findings?
A. To increase attack speed
B. To support reproducibility and reporting
C. To hide evidence
D. To bypass authorization
Answer: B
Explanation: Documentation allows findings to be reproduced,
validated, communicated, and remediated.
9. What is a false positive?
A. A real vulnerability missed by testing
B. A reported issue that is not actually present
C. A successful exploit
D. A compromised administrator account
Answer: B
Explanation: A false positive occurs when testing incorrectly identifies a
vulnerability.
10. What is a false negative?
A. A vulnerability incorrectly reported
B. A real vulnerability that testing fails to identify
, C. A valid credential
D. A confirmed service
Answer: B
Explanation: False negatives are dangerous because genuine
weaknesses remain undiscovered.
11. Which approach generally provides the most information about a
target?
A. Black-box
B. White-box
C. Blind testing
D. Passive-only testing
Answer: B
Explanation: White-box testing provides substantial internal
information such as source code, architecture, or credentials.
12. What characterizes black-box testing?
A. Full source-code access
B. Minimal prior information
C. Administrator access
D. Complete network diagrams
Answer: B
Explanation: Black-box testing simulates an attacker with little or no
internal knowledge.
13. What is gray-box testing?
A. Testing without authorization
B. Testing with limited internal knowledge
C. Testing only physical security
D. Testing only encryption
