OSCP practice.
Build confidence.
Build your penetration testing knowledge with focused practice. Review each explanation, revisit weak spots, and prepare with purpose.
Published by PrepForCerts · Editorial responsibility and sources
Free OSCP Practice Test 2026
Master the most respected hands-on penetration testing certification. Our practice questions prepare you for the grueling 24-hour OSCP exam with real-world scenarios covering exploitation, enumeration, and post-exploitation techniques.
OSCP: plan your preparation
OSCP validates practical penetration testing, from reconnaissance and vulnerability identification through exploitation, privilege escalation, and professional reporting. Build your methodology in authorized labs and use these questions for concept review.
Exam version and format
The current OSCP+ exam allows 23 hours 45 minutes for the practical test, followed by 24 hours to submit a report. It has three standalone machines worth 60 points and a three-machine Active Directory set worth 40 points. Passing requires 70/100. Knowledge questions support lab work; they do not simulate the practical exam.
Checked September 8, 2026. Read the official OSCP exam guidance before booking.
OSCP Exam Quick Facts
| Exam Code | PEN-200 |
| Full Name | Offensive Security Certified Professional |
| Exam Duration | 23 hours 45 minutes + 24 hours for report |
| Passing Score | 70 out of 100 points |
| Exam Cost | See current provider pricing |
| Validity Period | OSCP: lifetime; OSCP+: 3-year renewal cycle |
| Prerequisites | None (networking + Linux skills recommended) |
| Exam Format | Hands-on practical CTF-style |
| Machines | 3 standalone (60 pts) + 1 AD set (40 pts) |
| Average Salary | Varies by role, location, and experience |
OSCP Practice Topics
Review these penetration testing topics in an authorized lab. They are study groupings, not official exam domain weights. Use OffSec’s current guide to set exam priorities.
🔍 Information Gathering
Passive and active reconnaissance, service enumeration with Nmap, OS fingerprinting, DNS enumeration, and vulnerability identification through banner grabbing and version detection.
🎯 Vulnerability Analysis
Identifying misconfigurations, researching public exploits with Searchsploit, analyzing web application vulnerabilities, and prioritizing attack vectors based on likelihood of success.
🌐 Web Application Attacks
SQL injection (blind, error-based, UNION), cross-site scripting (XSS), local and remote file inclusion (LFI/RFI), command injection, and authentication bypass techniques.
💥 Buffer Overflow Exploitation
Windows x86 stack-based buffer overflows, identifying bad characters, generating shellcode with msfvenom, and understanding memory protection bypasses (DEP/ASLR concepts).
⬆️ Privilege Escalation
Linux and Windows privilege escalation techniques including SUID binaries, sudo misconfigurations, kernel exploits, service account abuse, and automated enumeration scripts.
🏢 Active Directory Attacks
Kerberoasting, AS-REP roasting, Pass-the-Hash, domain enumeration with BloodHound, lateral movement techniques, and exploiting trust relationships for domain compromise.
Ready to Test Your Skills?
Review penetration testing concepts before your next authorized lab session.
Start Practice Test →Real-World Scenarios
Practice questions designed around actual penetration testing methodologies used in professional engagements and the OSCP lab environment.
Exploitation Techniques
Review web application attacks, privilege escalation, post-exploitation, and optional buffer overflow fundamentals. Use the current PEN-200 outline to set lab priorities.
Instant Feedback
Get immediate explanations for each answer with detailed breakdowns of why certain approaches work and common mistakes to avoid.
Progress Tracking
Track your study streaks, monitor domain-specific readiness scores, and identify weak areas that need more lab time.
Methodology Training
Learn the systematic approach to enumeration and exploitation that separates successful OSCP candidates from those who fail.
Report Writing Prep
Understand documentation requirements and practice articulating your findings—the professional report is a required part of the assessment.
Why Practice Tests Work for OSCP
The OSCP exam is unlike any other certification. Here's why targeted practice questions are essential for your success.
Active Recall
Retrieval practice strengthens memory far more effectively than passive reading. Testing yourself on enumeration commands and exploitation steps builds lasting knowledge.
Identify Weak Areas
Discover which domains need more attention before you're 12 hours into a 24-hour exam. Focus your limited lab time on areas where you struggle most.
Build Methodology
Practice the systematic approach needed for the OSCP. Questions reinforce proper enumeration-before-exploitation habits that prevent rabbit holes.
Manage Exam Stress
Build confidence before the grueling exam experience. Knowing you've seen similar scenarios reduces panic when the clock is ticking.
Sample OSCP Practice Question
Question: During initial enumeration, you discover port 445 open on a Windows target. Which command would you use first to enumerate SMB shares and check for null session access?
Show Answer
Correct Answer: B
smbclient -L //target -N lists available SMB shares using a null session (-N flag means no password). This is the correct first step when you discover SMB on port 445. Options A, C, and D are web enumeration tools that don't apply to SMB.
💡 OSCP Tip: Always enumerate SMB thoroughly. Null sessions, guest access, and readable shares are common entry points on exam machines.
OSCP Study Tips
Maximize your exam preparation with these proven strategies from successful OSCP holders.
🔍 Enumerate Thoroughly
Document every port, service, and version. The answer is often in the enumeration—don't rush to exploitation before understanding the full attack surface.
📚 Learn Your Exploits
Understand exploits, don't just copy-paste. Modify public exploits to work in your environment. The exam often requires tweaking code.
⬆️ Master Privilege Escalation
Both initial access and privilege escalation contribute to scoring. Practice Linux and Windows privesc until enumeration scripts and manual techniques are second nature.
⏱️ Time Box Your Attempts
Don't spend 4 hours on one machine. If you're stuck, move on and return later with fresh eyes. The exam rewards breadth over depth.
📝 Take Detailed Notes
Your exam report is half the battle. Screenshot everything, document your methodology, and note exact commands used. Cherry Tree or Obsidian work well.
🔧 Use Searchsploit Effectively
Learn to search for and modify public exploits. Practice converting Python 2 exploits to Python 3 and adjusting shellcode for your target.
💡 Try Harder Philosophy
The OSCP is famous for its "Try Harder" mantra. This isn't just a catchphrase—it's a mindset. When you get stuck, dig deeper. Check for alternate ports, review your enumeration, try different exploit variations. The answer is always there; you just need to find it. This persistence is what separates OSCP holders from everyone else.
About OSCP Certification
What OSCP Validates
The Offensive Security Certified Professional (OSCP) certification validates that you can identify vulnerabilities, develop and execute exploits, and document your findings in a professional penetration testing report. Unlike theory-based certifications, OSCP proves you can actually compromise systems—making it the gold standard for penetration testing roles.
Industry Recognition
OSCP demonstrates practical penetration testing skills. The “Try Harder” approach emphasizes problem-solving and self-reliance. For government roles, check the current DoD 8140 qualification matrix and employer requirements; certification acceptance is role-specific.
Career Acceleration
OSCP can support penetration testing, red team, and security consulting roles. Compare current employer requirements and local pay data. Experience, role scope, and location affect compensation; the credential alone does not guarantee a salary.
Who Should Take OSCP?
👥 Security Analysts
Professionals seeking hands-on offensive skills to understand attacker methodologies and improve defensive capabilities.
💻 IT Professionals
Network and system administrators transitioning into penetration testing or red team roles.
🏆 CTF Enthusiasts
Capture the flag players ready to formalize their practical hacking skills with a recognized credential.
📈 Career Changers
Developers, consultants, or professionals serious about breaking into offensive security careers.
OSCP vs Other Certifications
OSCP vs CEH
CEH is multiple-choice theory; OSCP is 100% hands-on practical. OSCP proves you can actually compromise systems, making it significantly more respected for offensive security roles.
OSCP vs PenTest+
CompTIA PenTest+ includes performance-based questions but is less rigorous than OSCP's 24-hour practical exam. OSCP is preferred for dedicated penetration testing roles.
Example Study Timeline: Adapt to Your Skills
- Weeks 1-3: Networking & Linux Fundamentals — TCP/IP deep dive, Linux command line mastery, basic scripting
- Weeks 4-6: Web Application Attacks — SQL injection, XSS, LFI/RFI, command injection techniques
- Weeks 7-9: Buffer Overflow Mastery — Windows x86 exploitation, shellcode development, DEP/ASLR concepts
- Weeks 10-12: Privilege Escalation — Linux & Windows privesc, enumeration scripts, kernel exploits
- Weeks 13-16: Active Directory + Lab Machines — AD attacks, lateral movement, and completing 50+ lab machines
- Weeks 17-20: Mock Exams + Final Prep — Practice under exam conditions, refine methodology, report writing
What to Expect on Exam Day
🕐 Before the Exam
- Verify your proctoring software 24 hours ahead
- Prepare your workspace (clean desk, good lighting)
- Have your ID ready for verification
- Set up your note-taking system
- Prepare food and drinks for the 24-hour marathon
💻 During the Exam
- VPN into the exam lab environment
- Start with thorough enumeration of all machines
- Screenshot EVERYTHING for your report
- Time-box machines (2-3 hours max)
- Take scheduled breaks to stay sharp
📝 The Report
- 24 hours to write after exam ends
- Document complete methodology for each machine
- Include all commands, screenshots, and proof files
- Professional quality expected
- Submit the report archive in the format and portal specified by OffSec
🏆 Results
- Check OffSec’s current result notification time
- Pass/fail notification via email
- Digital badge and certificate if successful
- OSCP lifetime; OSCP+ renewal every 3 years
- Retakes available under current OffSec pricing and waiting periods
Use concept review alongside lab practice
Practice questions support active recall, help you find weak areas, and build a systematic approach. They can also reduce stress by making tools and attack patterns more familiar. The real assessment requires you to demonstrate those skills on live targets in the exam lab.
Keep a reproducible report
Use a consistent note system such as CherryTree or Obsidian. Record reconnaissance, exploitation, privilege escalation, commands, screenshots, and proof files so another reader can follow your work. Lab exercises still help preparation, but there are no bonus points on the current exam.
Choose your next learning goal
OSCP can support penetration tester, red team operator, and security consultant roles. It can also be a foundation for advanced OffSec study such as OSEP or OSED. Match the next course to your skill gaps and target role. No fixed total of lab hours guarantees a pass.
Who should study OSCP?
- Security analysts seeking hands-on offensive skills
- IT professionals transitioning to penetration testing
- Network admins wanting to understand attacker techniques
- CTF enthusiasts ready to formalize their skills
- Security consultants needing a recognized credential
- Anyone serious about a red team career
Build your OSCP study plan
- Enumerate Thoroughly: Document every port, service, and version. Missing a service = missing a foothold.
- Learn Your Exploits: Understand exploits, don't just copy-paste. Know why they work to adapt them.
- Practice Privilege Escalation: Initial access and privilege escalation both contribute to exam scoring. Master both Linux and Windows privesc.
- Time Box Your Attempts: Don't spend 4 hours on one machine. Move on and return with fresh perspective.
- Take Detailed Notes: Your exam report is half the battle. Document commands, screenshots, and methodology.
- Use Searchsploit Effectively: Learn to modify public exploits for your specific target environment.
Skills to review
These are learning topics, not weighted exam domains. Buffer overflow work is additional background; follow the current PEN-200 outline for required preparation.
- Information Gathering
- Passive and active reconnaissance, enumeration of services, OS detection, and vulnerability identification. Learn to map target networks thoroughly.
- Vulnerability Analysis
- Scanning with Nmap, identifying misconfigurations, researching public exploits, and validating vulnerabilities before exploitation.
- Web Application Attacks
- SQL injection, XSS, file inclusion, command injection, authentication bypasses, and API exploitation techniques.
- Buffer Overflow Exploitation
- Windows x86 buffer overflows, shellcode development, understanding DEP/ASLR, and exploit development fundamentals.
- Privilege Escalation
- Linux and Windows privesc techniques, kernel exploits, misconfigured services, SUID binaries, and scheduled tasks abuse.
- Active Directory Attacks
- Kerberoasting, AS-REP roasting, Pass-the-Hash, BloodHound enumeration, and domain privilege escalation paths.
Try these OSCP knowledge questions
Choose your answer, then review the explanation. These are independent learning examples, not official exam questions or a substitute for hands-on practice in an authorized lab.
Frequently Asked Questions
What is the OSCP exam format?
The OSCP exam is a 23-hour 45-minute hands-on penetration test where you attack multiple machines in a VPN-connected lab environment. You need 70 out of 100 points to pass. After the exam, you have 24 hours to submit a professional penetration testing report documenting your methodology and findings for each compromised machine.
What are the prerequisites for OSCP?
While there are no formal prerequisites, OffSec recommends solid understanding of TCP/IP networking, Linux and Windows administration, and basic scripting skills (Python, Bash). Experience with Kali Linux is highly beneficial. Most successful candidates have 1-2 years of IT experience before attempting OSCP.
How long does the OSCP course take?
PEN-200 study time depends on your starting skills and available lab time. A 3–6 month schedule can be a planning example, not a requirement or guarantee. Compare current OffSec packages for lab access, included attempts, and subscription terms; choose the package that fits your study schedule.
How does OSCP compare to CEH?
OSCP assesses practical exploitation and reporting in a lab. CEH’s knowledge exam uses multiple-choice questions; CEH Practical is a separate hands-on assessment. Choose based on your target role and experience rather than assuming one credential is preferred by every employer.
Does OSCP certification expire?
OSCP itself remains valid for life. Passing the updated exam awards OSCP and OSCP+; the + designation has a 3-year renewal cycle. If you do not maintain the +, you keep OSCP. Continued study toward OSEP, OSWE, or other relevant skills can support career development; check OffSec’s qualifying renewal routes.
How many machines are on the OSCP exam?
The current exam has three standalone machines (60 points total) and a three-machine AD set (40 points). You start the AD section with supplied credentials and can earn partial credit. Passing requires 70/100, so a complete 40-point AD set and one 20-point standalone alone are not enough.
Can I use Metasploit on the OSCP exam?
Metasploit is restricted to one target machine and cannot be used to pivot across targets. Follow OffSec’s complete rules for Meterpreter, automated exploitation, scanners, and AI tools. AI chatbots are prohibited during both the exam and reporting phase.
What happens if I fail the OSCP exam?
Review the areas that need more practice, then check OffSec’s current retake fees, subscription entitlements, and cooling-off periods before booking. Included attempts and timing depend on your package and attempt history.
How should I document during the OSCP exam?
Take screenshots of EVERY step: initial reconnaissance, exploitation, privilege escalation, and proof files. Your report must be detailed enough that a reader could reproduce your attacks. Use a consistent note-taking system like CherryTree or Obsidian.
How long does OSCP preparation take?
A 3–6 month plan with regular weekly study can be a starting example. Adapt it to your skills and lab access. Combine PEN-200 labs with suitable authorized practice on platforms such as Hack The Box or TryHackMe; readiness matters more than a fixed hour total.
Is OSCP harder than CEH?
OSCP assesses practical exploitation and reporting in a lab. CEH’s knowledge exam uses multiple-choice questions; CEH Practical is a separate hands-on assessment. Choose based on your target role and experience rather than assuming one credential is preferred by every employer.
What are the OSCP prerequisites?
There are no formal prerequisites for the credential. Build TCP/IP networking, Linux and Windows administration, and Python or Bash scripting skills before PEN-200. Start with suitable fundamentals training if these areas are new to you.
What tools should I master for OSCP?
Focus on: Nmap for scanning, Gobuster/Feroxbuster for web enumeration, Burp Suite for web testing, LinPEAS/WinPEAS for privilege escalation enumeration, searchsploit for exploit research, and various privesc techniques. Manual methodology is more important than tools.
Do I need an account to use these samples?
You can read the samples without an account. Create an account to save Smart Practice progress. The Free plan includes 15 questions per day; see Pricing for current plan features.
Can I study OSCP on my phone?
Yes. Read the questions and explanations on a phone, tablet, or computer. Use a suitable computer and authorized lab for practical testing.
Start Your OSCP Journey Today
Join thousands of security professionals preparing for the most respected penetration testing certification.
Start Free Practice Test →Read the samples without an account. Create an account for Smart Practice; the Free plan includes 15 questions per day.
Study & exam prep
- OSCP overview (this page)
Complete guide to the certification
- How to Pass OSCP
Proven strategies and study tips from successful OSCP holders.
Compare & plan
- OSCP vs CEH
Compare the two most popular ethical hacking certifications.
- Cybersecurity Path
Career progression roadmap for security professionals.
- Cybersecurity certifications
Explore all cybersecurity certifications.
Related practice tests
- PenTest+ Practice Test
CompTIA's vendor-neutral penetration testing certification.
- CEH Practice Test
EC-Council's Certified Ethical Hacker exam prep.
- CySA+ Practice Test
Defensive security and threat analysis certification.
- Security+ Practice Test
Entry-level security certification from CompTIA.
- CISSP Practice Test
Advanced security management and architecture.