Question 1

Which LDAP attribute is typically used by attackers to identify accounts that never expire?

Options :

A : userAccountControl

B : msDS-AllowedToDelegateTo

C : servicePrincipalName

D : lastLogonTimestamp

Answer: A

Question 2

After getting initial access, you use netstat -ano and spot a suspicious service listening on port 5985. What service is this and how can it help?

Options :

A : RDP – Used for screen sharing

B : DNS – Internal name resolution

C : SMB – File sharing

D : WinRM – Can allow remote code execution via PS Remoting

Answer: D

Question 3

You want to create stealthy persistence on a Domain Controller using minimal file operations. What is a suitable technique?

Options :

A : Install a backdoor service

B : Add a new user to administrators

C : Create a skeleton key via mimikatz

D : Create an AlwaysInstallElevated MSI payload

Answer: C

Question 4

You’re red teaming and impersonate a helpdesk rep to reset a C-level user’s password. You succeed.

What do you document in the report?

Options :

A : Only the password reset

B : Include the impersonation steps, script, and responses

C : Just the outcome

D : Exclude it because it’s too sensitive

Answer: B

Question 5

You’ve dumped SAM and SYSTEM hives on a Windows host. What can you extract? (Select all that apply)

Options :

A : NTLM password hashes

B : User login timestamps

C : SID of local accounts

D : Kerberos tickets

Answer: A,B,C

Free OSCP Mock Exam – Practice Online Confidently