Question 1

$file = $_GET['page'];

include($file);

?>

What vulnerability is present in this PHP snippet?

Options :

A : Command Injection

B : SQL Injection

C : Local File Inclusion

D : Cross-site scripting

Answer: C

Question 2

You’ve dumped SAM and SYSTEM hives on a Windows host. What can you extract? (Select all that apply)

Options :

A : NTLM password hashes

B : User login timestamps

C : SID of local accounts

D : Kerberos tickets

Answer: A,B,C

Question 3

During a red team assessment, you discover credentials belonging to a third-party vendor while scanning a misconfigured internal share. You are unsure whether accessing the vendor’s systems is within scope. What is the most appropriate action?

Options :

A : Attempt access to validate the credentials.

B : Notify your team lead or point of contact immediately.

C : Log the finding in your report and proceed with testing.

D : Contact the vendor directly to ask for permission.

Answer: B

Question 4

Which LDAP attribute is typically used by attackers to identify accounts that never expire?

Options :

A : userAccountControl

B : msDS-AllowedToDelegateTo

C : servicePrincipalName

D : lastLogonTimestamp

Answer: A

Question 5

Which of the following tools does NOT support direct CVE-based vulnerability matching?

Options :

A : Nuclei

B : Nessus

C : Nikto

D : OpenVAS

Answer: C

Free OSCP Mock Exam – Practice Online Confidently

Buying Options: