DOMAINS:
Reconnaissance & Scanning (1-15)
Web Application Attacks (16-30)
Buffer Overflows (31-40)
Privilege Escalation: Windows (41-55)
Privilege Escalation: Linux (56-70)
Password Attacks & Late
...
DOMAINS:
Reconnaissance & Scanning (1-15)
Web Application Attacks (16-30)
Buffer Overflows (31-40)
Privilege Escalation: Windows (41-55)
Privilege Escalation: Linux (56-70)
Password Attacks & Lateral Movement (71-85)
Pivoting, Port Forwarding & Metasploit (86-100)
Each question includes the correct answer and a rationale
Domain 1: Reconnaissance & Scanning
1. During an external penetration test, you discover that the target domain
"target.local" has a DNS record for "vpn.target.local" that points to a public IP.
What is the most critical piece of information to gather next?
A) The operating system of the web server on that IP
B) Whether the VPN service allows split-tunneling
C) The version of the SSL/TLS certificate
D) The presence of a "Connect to VPN" portal on port 443 or 8443
Rationale: If the VPN service is exposed, it becomes a prime attack surface. Credential
stuffing, phishing, or exploiting known VPN vulnerabilities (e.g., Fortinet, Pulse Secure)
often provide initial access to the internal network, bypassing perimeter firewalls.
2. You run nmap -sS -sV -p- -T4 10.10.10.10 but the scan is taking too long. What
optimization technique would most effectively reduce scan time without losing
critical service information on high ports?
A) Increase timing to -T5
B) Use -sU instead of -sS
C) Run an initial -p- scan with --min-rate 5000, then a separate -sV scan on open
ports
D) Disable host discovery with -Pn
*Rationale: The -p- flag scans all 65535 ports, which is slow. The OSCP methodology
often involves a "quick" all-ports scan using high min-rate to find open ports quickly,
followed by a targeted version scan. -T5 can cause packet loss and inaccurate results.*
3. A WAF is blocking your Nmap scans. Which of the following techniques is least
likely to trigger the WAF during a port scan?
[Show More]
