Free OffSec OSCP Exam Questions

Become OffSec Certified with updated OSCP exam questions and correct answers

Page: 1 / 47

Total 234 Questions | Updated On: Jun 16, 2026

Add To Cart

Question 1

During a bug bounty assessment, you find a reflected XSS payload works only when clicking from an internal page and fails in direct request. What is likely protecting it?

A : HTTP-only cookie

B : CSRF token

C : Referer header validation

D : Content Security Policy

Answer: C

Question 2

Which protocol is most likely to reveal internal hostnames during DNS enumeration?

A : SMTP

B : HTTP

C : DNS

D : FTP

Answer: C

Question 3

What types of information can be gathered using Amass? (Select all that apply)

A : ASN (Autonomous System Numbers)

B : Subdomains

C : IP addresses

D : Passwords

Answer: A,B,C

Question 4

During a red team assessment, you discover credentials belonging to a third-party vendor while scanning a misconfigured internal share. You are unsure whether accessing the vendor’s systems is within scope. What is the most appropriate action?

A : Attempt access to validate the credentials.

B : Notify your team lead or point of contact immediately.

C : Log the finding in your report and proceed with testing.

D : Contact the vendor directly to ask for permission.

Answer: B

Question 5

Which of the following best explains why impact ratings are used in a penetration test report?

A : To show the CVSS base score

B : To prioritize remediation based on business risk

C : To explain the value of automation

D : To justify tool selection

Answer: B

Page: 1 / 47

Total 234 Questions | Updated On: Jun 16, 2026

Add To Cart