OSCP Interview Questions and Answers: 30 Questions on Method, Enumeration and Reporting

Key takeaways

• OSCP is the practical PEN-200 certification; interviewers ask how you think as well as what you ran.
• Explain a repeatable methodology: scope, enumerate, validate, exploit within authority, document, remediate.
• Enumeration depth is the most common differentiator.
• Always mention written authorisation, rules of engagement and the impact on production.
• Be able to describe one lab box end to end, and the report you wrote.

What does an OSCP interview test?

OSCP is the Offensive Security certification attached to the PEN-200 course, known for its hands-on exam. Employers hiring penetration testers or security consultants ask about method, judgement and communication. The answers below are concept-level, for authorised testing and lab practice only. In India, testing without written permission is an offence under the Information Technology Act, 2000.

Methodology and ethics

1. Describe your penetration testing methodology.

Agree scope and rules of engagement, gather information, enumerate services, identify and validate weaknesses, exploit only within authority, gain evidence, then report and support remediation.

2. What must be in place before a test starts?

A signed contract, written authorisation, a defined scope with IP ranges and times, emergency contacts, data handling rules and agreed limits such as no denial of service.

3. What do you do if you find something out of scope?

Stop, do not touch it, document what you saw and inform the client contact, so they can decide whether to extend the scope in writing.

4. How do you avoid disrupting production?

Use careful scan rates, avoid destructive checks, test in agreed windows, and have a contact to call if something degrades.

5. What is the difference between a vulnerability assessment and a penetration test?

An assessment lists and ranks weaknesses, often with scanners. A penetration test validates and chains weaknesses to show real impact, within an agreed scope.

Enumeration

6. Why is enumeration so important?

Most compromises come from missed detail: an unexpected service, a version, a share, a configuration. Thorough enumeration finds more options and saves time.

7. How would you enumerate a host with a web server?

Identify the technology and version, review content and directories, check authentication and input points, look at headers and certificates, and note anything unusual.

8. What do you look for in SMB and file shares?

Anonymous or guest access, readable shares, sensitive files, version information and weak configuration, all within authorised scope.

9. What do you do when a scan shows few ports?

Check all TCP ports, consider UDP, re-scan carefully for filtered ports and look for application behaviour that hides services, not assume nothing is there.

10. How do you prioritise findings?

By exploitability, impact and the privilege gained, then by effort. Quick, high-impact paths come first, but note everything.

Exploitation and escalation (concepts)

11. How do you decide whether a public exploit is safe to use?

Read the code, understand what it does, test it in a lab copy, check for destructive effects and adapt it. Never run unreviewed code against a client system.

12. What are common Linux privilege escalation vectors?

Weak file permissions, misconfigured sudo rules, SUID binaries, scheduled jobs running writable scripts, kernel flaws and exposed credentials.

13. What are common Windows privilege escalation vectors?

Unquoted service paths, weak service permissions, stored credentials, misconfigured scheduled tasks and unpatched components.

14. What is a reverse shell versus a bind shell?

A bind shell listens on the target for a connection. A reverse shell connects out from the target to the tester. Reverse shells are common because inbound firewall rules often block bind shells.

15. How do you stabilise and document a shell?

Upgrade it for a usable terminal, record commands and timestamps, and capture proof such as a hostname and user without exposing sensitive data.

16. How would you test a web login safely?

Check for default credentials, injection, weak session handling and rate limits, using test accounts and avoiding lockouts of real users.

Pivoting and Active Directory

17. What is pivoting?

Using a compromised host as a stepping stone to reach network segments that the tester cannot reach directly, usually through port forwarding or tunnelling.

18. What is the difference between local and remote port forwarding?

Local forwarding exposes a remote service on a local port through a tunnel. Remote forwarding exposes a local service on the remote host. Choose by which side needs to initiate the connection.

19. What do you enumerate first in an Active Directory network?

Domain structure, users and groups, privileged accounts, computers, shares, policies and trust relationships.

20. Name common Active Directory weaknesses.

Weak or reused passwords, excessive privileges, misconfigured delegation, exposed service accounts, legacy protocols and poor segmentation.

21. How can defenders reduce Active Directory risk?

Enforce least privilege, tiered administration, strong password and multi-factor policy, patching, monitoring of privileged activity and removing unnecessary legacy protocols.

Reporting and communication

22. What makes a good penetration test report?

An executive summary, scope and method, findings with severity, evidence, business impact, reproducible steps and clear remediation advice.

23. How do you rate severity?

Use a consistent scheme such as CVSS plus context: exposure, data sensitivity, exploitability and compensating controls.

24. How do you explain a finding to a non-technical manager?

State the risk in business terms, such as what could be accessed or stopped, how likely it is and what the fix costs in effort.

25. How do you handle sensitive data found during a test?

Minimise access, do not copy more than needed, store evidence securely, follow the data handling terms, and delete it as agreed.

Practical and behavioural

26. Walk through a lab machine you compromised.

Use a structure: enumeration, finding, validation, access, escalation, evidence and the fix that would have prevented it. Mention what you tried that did not work.

27. What do you do when you are stuck?

Re-enumerate, review notes for missed detail, try a different approach and take a break. Describe asking for help in a team, too.

28. How do you keep your skills current?

Practise in labs and CTFs, read advisories and vendor documentation, follow reputable research and write up what you learn.

29. What tools do you use and why?

Name a few, and explain what each does and what you do when it is unavailable. Tools matter less than understanding what they send on the wire.

30. Why should we hire you?

Show a method, a sense of responsibility, clear writing and examples of learning from failure.

Common mistakes

• Listing tools without explaining method.
• Forgetting authorisation and scope in answers.
• Claiming experience you cannot demonstrate.
• Describing only successes.

Next steps

Prepare with the OSCP training. Related reading: VAPT interview questions and CEH interview questions.