PEN-200 Port Redirection and Tunneling Practice Question
During an internal penetration test, you compromise a Windows host that has two network interfaces: one on your attack network (10.10.10.0/24) and one on a restricted internal network (172.16.5.0/24). You need to scan a web server at 172.16.5.20:80 from your Kali machine. You decide to use SSH dynamic port forwarding. Which command should you run on your Kali machine to create a SOCKS proxy listening on localhost port 1080 through the compromised Windows host (10.10.10.15) using SSH?
⚠ Common exam trap
Watch out — candidates often confuse dynamic port forwarding (-D) with local port forwarding (-L), which only forwards to a single predetermined destination and does not provide a general-purpose SOCKS proxy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ssh -D 1080 user@10.10.10.15
To pivot into an internal network using SSH dynamic port forwarding, the -D option creates a SOCKS proxy on the specified local port. This allows tools like proxychains or browser proxies to route traffic through the SSH tunnel to any host reachable by the compromised server. The command must specify the SSH server address, which is the compromised host's IP on the attack network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ssh -R 1080:172.16.5.20:80 user@10.10.10.15
Why it's wrong here
This sets up a remote port forward, where the SSH server listens on its local port 1080 and forwards connections back to your machine's port 172.16.5.20:80. That is the opposite direction and does not create a SOCKS proxy on your Kali machine. It would not allow you to scan the internal network from your attacking host.
- ✓
ssh -D 1080 user@10.10.10.15
Why this is correct
This command creates a dynamic port forward (SOCKS proxy) on local port 1080 and connects to the SSH server at 10.10.10.15. Once authenticated, any traffic sent through the SOCKS proxy is tunneled through the SSH connection and forwarded to the target network, allowing you to reach 172.16.5.20.
- ✗
ssh -D 1080 -L 80:172.16.5.20:80 user@10.10.10.15
Why it's wrong here
This combines a dynamic forward on port 1080 with a local forward on port 80 to the web server. While the dynamic forward would work, the extra local forward is unnecessary and could cause confusion. The question asks for a SOCKS proxy, which is achieved with -D alone. Adding -L does not invalidate the proxy but is not the cleanest answer.
- ✗
ssh -L 1080:172.16.5.20:80 user@10.10.10.15
Why it's wrong here
This command sets up a local port forward from local port 1080 to 172.16.5.20:80 via the SSH server. It only forwards traffic to that specific host and port, not a dynamic SOCKS proxy. You would need to configure your tools to connect to localhost:1080, but it would only reach the web server, not other services on the internal network.
About these practice questions
Courseiva writes every PEN-200 question from scratch — 285 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.