Sample Questions from OSCP+ (New Advanced) (OSCP+) by OffSec

Preview a few questions below — answers are revealed when you take the exam.

1. A team needs to secure a web application using OAuth 2.0 for authentication. What approach should they take to ensure the security of access tokens and prevent token leakage?

   • Implementing short-lived access tokens, using the Authorization Code Grant with PKCE, and storing tokens securely in HTTP-only cookies.
   • Using long-lived access tokens, storing them in local storage, and relying on client-side validation for token integrity.
   • Employing JWT tokens with no expiration, storing them in session storage, and using them for all API requests without additional validation.
   • Storing access tokens in plain text within the application's database and using them directly for API authentication.

2. Consider the situation where an organization experiences frequent SQL injection attacks. Which method solves it best by integrating multiple security layers?

   • Applying input validation, using prepared statements, implementing a Web Application Firewall (WAF), and conducting regular security audits.
   • Relying solely on input validation and hoping for the best without additional security measures.
   • Using only prepared statements and assuming they are sufficient to prevent all SQL injection attacks.
   • Implementing a WAF and believing it will handle all security concerns without other measures.

3. What strategy should be applied when designing a secure microservices architecture to prevent data breaches?

   • Ensuring each microservice uses its own database, implementing strong authentication and authorization, encrypting data in transit and at rest, and regularly auditing access logs.
   • Storing all microservices' data in a single shared database to simplify management.
   • Using default configurations for all microservices and assuming they are secure out of the box.
   • Relying solely on network-level security without implementing application-level security measures.

4. How would you decide the best method for securing a containerized application in a Kubernetes cluster?

   • Using secure images, implementing RBAC, regularly updating containers, scanning for vulnerabilities, and monitoring container activities.
   • Deploying containers without any security configurations and hoping for the best.
   • Relying solely on the default security configurations provided by Kubernetes.
   • Using only network policies without implementing other security measures.

5. What configuration is most appropriate for implementing a zero-trust security model in a corporate network?

   • Verifying every access request, using multi-factor authentication, encrypting all data in transit, and continuously monitoring user activities.
   • Allowing unrestricted access to all network resources for authenticated users.
   • Relying solely on perimeter-based security measures without internal segmentation.
   • Using a single sign-on solution without additional security checks.