10 beginner questions on the PEN-200 topic areas: the CIA triad, service enumeration with Nmap and SMB, directory traversal and stored XSS, offline hash cracking, SUID privilege escalation and SSH port forwarding, Kerberoasting in Active Directory, and S3 Block Public Access in AWS.

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. Which two are security objectives of the CIA triad? (Select TWO)

    • A. Confidentiality ✔ correct
    • B. Availability ✔ correct
    • C. Authentication
    • D. Accountability
    • E. Anonymity

    Answer: A, B. The CIA triad is confidentiality, integrity and availability, the three security objectives defined in FIPS 199. Authentication and accountability are supporting security services, not members of the triad.

    Source: csrc.nist.gov/pubs/fips/199/final · Domain: Introduction to cybersecurity and an effective learning strategy

  2. A penetration tester has found open ports on a host and now wants to identify which service and software version is running on each port. Which Nmap option enables this?

    • A. -sn
    • B. -sV ✔ correct
    • C. -sU
    • D. -Pn

    Answer: B. -sV enables version detection, which probes open ports to identify the service and its version. -sn only discovers hosts, -sU scans UDP ports and -Pn skips host discovery.

    Source: nmap.org/book/man-version-detection.html · Domain: Enumeration and information gathering, including vulnerability scanning and vulnerability assessment

  3. During an authorized test for a company, a tester finds TCP port 445 open on a Windows server. Which service should the tester enumerate next?

    • A. Remote Desktop Protocol (RDP)
    • B. Secure Shell (SSH)
    • C. Server Message Block (SMB) ✔ correct
    • D. Domain Name System (DNS)

    Answer: C. Modern Windows runs SMB directly over TCP port 445, so the next step is to enumerate SMB shares, versions and signing. RDP normally uses port 3389, SSH port 22 and DNS port 53.

    Source: learn.microsoft.com/en-us/troubleshoot/windows-server/networking/direct-hosting- · Domain: Enumeration and information gathering, including vulnerability scanning and vulnerability assessment

  4. A web application loads files with a URL such as download.php?file=report.pdf. A tester changes it to file=../../../../etc/passwd and receives the system's password file. Which vulnerability is this?

    • A. Directory (path) traversal ✔ correct
    • B. Cross-site request forgery
    • C. SQL injection
    • D. Server-side template injection

    Answer: A. Path traversal uses ../ sequences to access files outside the web root that the application should not serve. Fix it by validating input against an allow list and not passing user input straight to file APIs.

    Source: owasp.org/www-community/attacks/Path_Traversal · Domain: Perimeter attacks in web and application security as well as client-side attacks

  5. A tester posts a comment containing a <script> tag on a forum. The script is saved and later runs in the browser of every user who views the page. What type of cross-site scripting (XSS) is this?

    • A. Reflected XSS
    • B. DOM-based XSS only
    • C. Blind SQL injection
    • D. Stored XSS ✔ correct

    Answer: D. In stored (persistent) XSS the injected script is saved on the server, for example in a comment, and served to every visitor. Reflected XSS is returned immediately in the response to a crafted request and is not stored.

    Source: owasp.org/www-community/attacks/xss/ · Domain: Perimeter attacks in web and application security as well as client-side attacks

  6. A tester has extracted a file of password hashes from a compromised host and wants to crack them offline using a GPU. Which tool is designed for this?

    • A. Hydra
    • B. Hashcat ✔ correct
    • C. Nessus
    • D. Burp Suite

    Answer: B. Hashcat is an offline password recovery tool that cracks hashes using CPUs and GPUs. Hydra performs online guessing against live login services, Nessus is a vulnerability scanner and Burp Suite is a web proxy.

    Source: hashcat.net/hashcat/ · Domain: Password attacks and Anti-Virus Evasion

  7. On a Linux host, a tester finds a program owned by root that has the set-user-ID (SUID) bit set. Why can this be a privilege escalation path?

    • A. The program can only be deleted by the root user
    • B. The program runs with root's effective user ID ✔ correct
    • C. The program is excluded from all system logging
    • D. The program automatically opens a network port

    Answer: B. When a SUID program runs, the process's effective user ID becomes the file owner's, here root. If the program can be abused to run commands or write files, a normal user can gain root privileges.

    Source: man7.org/linux/man-pages/man2/execve.2.html · Domain: Windows and Linux privilege escalation and lateral movements, including pivoting and tunneling techniques

  8. With SSH local port forwarding (ssh -L), connections to a port on your own machine are forwarded through the SSH server to a host and port on the remote side.

    • A. True ✔ correct
    • B. False

    Answer: A. True. -L listens on a local port and forwards each connection over the SSH session to a host and port reached from the server, so a tester can reach an internal service from their own machine (pivoting).

    Source: man.openbsd.org/ssh · Domain: Windows and Linux privilege escalation and lateral movements, including pivoting and tunneling techniques

  9. A user account in an Active Directory domain is used to request Kerberos service tickets for accounts that have a service principal name (SPN), and the tickets are then cracked offline to reveal the service accounts' passwords. What is this technique called?

    • A. Pass-the-hash
    • B. DCSync
    • C. Kerberoasting ✔ correct
    • D. Golden ticket

    Answer: C. Kerberoasting abuses the fact that any domain user can request service tickets for SPN accounts. Part of the ticket is encrypted with the service account's password hash, so weak passwords can be cracked offline.

    Source: attack.mitre.org/techniques/T1558/003/ · Domain: Active Directory, attacking Active Directory authentication, and lateral movement in Active Directory

  10. During a cloud assessment, a tester finds an Amazon S3 bucket that anyone on the internet can list. Which AWS feature lets administrators centrally prevent public access to S3 buckets?

    • A. S3 Transfer Acceleration
    • B. S3 Lifecycle rules
    • C. S3 Versioning
    • D. S3 Block Public Access ✔ correct

    Answer: D. S3 Block Public Access settings override bucket policies, access point policies and object permissions to limit public access, and can be set centrally by administrators. Versioning, lifecycle rules and Transfer Acceleration do not control access.

    Source: docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access · Domain: Enumerating and attacking AWS cloud infrastructure

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public OffSec exam objectives (PEN-200 (Penetration Testing with Kali Linux) topic list for the OSCP/OSCP+ exam, as worded on the official course page (checked 2026-10-25)), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by OffSec; exam names are trademarks of their owners. Official exam page: www.offsec.com/courses/pen-200/.

Last modified: Sunday, 25 October 2026, 9:57 PM