How many Troubleshooting Scenario Questions questions are on this page?

This page has 5 Troubleshooting Scenario Questions scenario questions for the PEN-200 exam, each with detailed explanations and wrong-answer analysis.

How should I approach PEN-200 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to OffSec PEN-200 / OSCP Concepts questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise OffSec PEN-200 / OSCP Concepts practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

PEN-200

exam code

OffSec

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

Refer to the exhibit. You are running a public exploit, but it fails with a 'Connection refused' error. What should you investigate first?

Exhibit

Error: [Errno 111] Connection refused
Target: 10.10.10.5:8080
Payload: reverse_tcp

A
The exploit's payload encoding settings.
Why it fails: Payload encoding affects how data is transmitted to bypass filters, not the initial network connection. If you cannot connect to the port, the payload never reaches the service. You must verify connectivity before worrying about payload-specific issues like encoding or bypassing security controls.
B
The service availability and network path to the target.
Before troubleshooting the exploit, you must confirm the service is actually listening on the target port. A 'Connection refused' error suggests the port is closed or filtered. Verifying network connectivity ensures you are not wasting time on an exploit that has no chance of succeeding.
C
The exploit's memory address offsets.
Why it fails: Memory offsets are only relevant after you have successfully connected to the service and started the exploitation process. A network-level error indicates that the connection has not even been established, making memory address issues irrelevant until the underlying connectivity problem is resolved.
D
The target's operating system version.
Why it fails: While the OS version is important, it is not the immediate cause of a 'Connection refused' error. This error is specific to network communication. You should first focus on port status and service availability before diving into environmental differences like the specific OS running on the target.

Full breakdown with real-world context →

Question 2easymultiple choice

Full question →

You are analyzing a target web application that reflects user input directly into an HTML attribute without proper sanitization. Which vulnerability class should you primarily investigate for exploitation?

A
SQL Injection
Why it fails: SQL injection involves manipulating database queries rather than targeting user browsers through reflected markup. This vulnerability manifests when input is concatenated directly into backend SQL statements, leading to data exposure or authentication bypass instead of client-side script execution.
B
Cross-Site Scripting (XSS)
Reflected XSS targets client-side execution by injecting malicious JavaScript through unvalidated parameters that get rendered immediately. This vulnerability allows attackers to steal session cookies, capture keystrokes, or perform actions on behalf of the authenticated user when they click a crafted link.
C
Remote Code Execution
Why it fails: Remote code execution affects the server-side application logic by allowing attackers to execute operating system commands via vulnerable functions. Unlike client-side XSS, RCE compromises the underlying server infrastructure rather than the browser context of individual visiting users.
D
Cross-Site Request Forgery
Why it fails: CSRF forces an authenticated user to execute unwanted actions on a web application in which they are currently logged in. It relies on predictable request parameters rather than injecting and executing arbitrary scripts within the context of the victim browser.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

What is the primary security risk of an application that fails to properly validate the 'Content-Type' header during a file upload process?

A
It allows attackers to perform SQL Injection attacks.
Why it fails: File upload vulnerabilities are unrelated to database query manipulation. SQL injection occurs when input is used in queries, whereas file upload flaws exploit the server's file storage and execution logic. These are distinct attack vectors requiring different mitigation strategies.
B
It enables an attacker to bypass file type restrictions to upload executable scripts.
The Content-Type header is easily modified in an intercepting proxy. If the server trusts this header, an attacker can send a PHP script while labeling it as 'image/jpeg'. The server accepts it, potentially allowing the attacker to execute malicious code on the system.
C
It prevents the server from storing large files, leading to denial of service.
Why it fails: The Content-Type header does not control file size limits. While large file uploads can lead to resource exhaustion, this is an issue of request size validation and rate limiting, not header validation. The header specifically relates to file type identification, not size management.
D
It exposes the server to Cross-Site Request Forgery (CSRF) attacks.
Why it fails: CSRF exploits the way browsers handle cookies, not the file upload process or its metadata. Failing to validate headers during an upload does not inherently facilitate CSRF; rather, it creates a risk of malicious file execution or unauthorized storage on the server.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

You are exploiting a buffer overflow in a 32-bit Windows application and have overwritten EIP with a JMP ESP address. However, when the shellcode executes, it fails to establish a reverse shell, and the application crashes. You suspect that the shellcode contains bad characters. Which of the following is the most effective way to identify bad characters in the shellcode?

A
Encode the shellcode with an XOR encoder and assume that all bad characters are resolved.
Why it fails: Encoding the shellcode can avoid bad characters, but it does not identify them. Without knowing which characters are bad, you might choose an encoder that still produces bad characters, or the decoder stub itself might contain bad characters. It is essential to first identify the bad characters, then choose an appropriate encoder that avoids them. Blindly encoding is not a reliable method.
B
Send a series of 'A' characters followed by the shellcode and check if the shellcode executes.
Why it fails: This approach does not isolate bad characters. If the shellcode fails, it could be due to bad characters, incorrect offset, or other issues. Without a systematic test, you cannot pinpoint which characters are problematic. The all-bytes test is the standard method to identify bad characters efficiently.
C
Use a debugger to set a breakpoint at the start of the shellcode and step through each instruction to see where it fails.
Why it fails: Stepping through the shellcode can help identify where execution deviates, but it is time-consuming and may not directly reveal which characters are filtered by the application. Bad characters often cause the payload to be truncated or altered before execution, so the shellcode may never reach the breakpoint intact. The systematic byte test is more effective for identifying bad characters.
D
Send all possible byte values (0x00 to 0xFF) in a buffer and observe which bytes are missing or altered in memory after the crash.
By sending a buffer containing all byte values from 0x00 to 0xFF, you can compare the bytes in memory (using a debugger) to the original sequence. Any byte that is missing, truncated, or altered indicates a bad character that the application filters or that terminates the string. This method systematically identifies all bad characters in one go, allowing you to encode the shellcode accordingly.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

You have gained a foothold on an internal Linux host (10.10.10.20) that can reach a segregated network containing a web server at 192.168.100.50:80. Your attack machine cannot reach 192.168.100.50 directly. You want to use the compromised host to forward traffic from your machine's local port 8080 to 192.168.100.50:80. Which SSH command should you run from your attack machine?

A
ssh -D 8080 user@10.10.10.20
Why it fails: Dynamic port forwarding (-D) creates a SOCKS proxy on your local port 8080, but it does not directly map to a specific internal host and port. You would need to configure a SOCKS-aware client to route traffic through it, rather than simply connecting to localhost:8080 as a direct forward.
B
ssh -L 80:192.168.100.50:8080 user@10.10.10.20
Why it fails: This command forwards local port 80 to 192.168.100.50:8080. It reverses the ports: the internal web server listens on port 80, not 8080, and binding local port 80 may require elevated privileges. It would not correctly forward traffic to the web service.
C
ssh -R 8080:192.168.100.50:80 user@10.10.10.20
Why it fails: Remote port forwarding (-R) makes the remote SSH server listen on a port and forward connections back to your local machine. That would expose a service on your machine to the internal network, not allow you to reach the internal web server from your attack box.
D
ssh -L 8080:192.168.100.50:80 user@10.10.10.20
This command creates a local port forward: it listens on your local port 8080 and forwards connections through the SSH tunnel to 192.168.100.50:80 from the perspective of the compromised host. This is exactly what is needed to reach the internal web server via the pivot.

Full breakdown with real-world context →

These PEN-200 practice questions are part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style PEN-200 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related PEN-200 topic practice pages

Client-Side Attacks practice questions

Enumeration and Reconnaissance practice questions

Active Directory Attacks practice questions

Public Exploits practice questions

Web Application Attacks practice questions

Linux Privilege Escalation practice questions

Buffer Overflow Fundamentals practice questions

Port Redirection and Tunneling practice questions

Antivirus Evasion practice questions

Password Attacks practice questions

Windows Privilege Escalation practice questions

PEN-200 fundamentals practice questions

Practice scenarios

Refer to the exhibit. You are running a public exploit, but it fails with a 'Connection refused' error. What should you investigate first?

Exhibit

You are analyzing a target web application that reflects user input directly into an HTML attribute without proper sanitization. Which vulnerability class should you primarily investigate for exploitation?

What is the primary security risk of an application that fails to properly validate the 'Content-Type' header during a file upload process?