Question 1
In modern 64-bit Windows exploitation, what does HVCI (Hypervisor-protected Code Integrity) primarily prevent an attacker from doing in kernel mode?
Correct Answer:
Executing unsigned code pages in kernel memory
Question 2
Which WinDbg command lists all loaded kernel driver objects and is commonly used during OSEE-style IOCTL analysis?
Correct Answer:
!drvobj 2
Question 3
On Windows 10/11 x64, what is the offset commonly traversed from KPROCESS/EPROCESS to locate the Token pointer used in SYSTEM token-stealing shellcode?
Correct Answer:
A build-specific offset that must be resolved per Windows version
Question 4
Which IOCTL macro layout field in Windows DDK describes whether buffered I/O, direct I/O, or neither is used for the request?
Correct Answer:
TransferType (Method)
Question 5
Which mitigation makes a classic 'smash the stack and jump to shellcode on the kernel stack' unreliable even without HVCI?
Correct Answer:
SMEP (Supervisor Mode Execution Prevention)
Question 1
Exam overview

About this Exam

Prepare with the OSEE Practice Questions - OffSec Exploitation Expert (OSEE) Exam practice quiz. This question bank includes 100 questions covering kernel, windows, osee, exploitation, and exploit. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

OSEE Practice Questions - OffSec Exploitation Expert (OSEE) Exam

This practice set contains 100 questions from the matching question bank and focuses on kernel, windows, osee, exploitation, and exploit. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.
No fixed duration is currently configured for this quiz.
Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.
Yes. You can retake the practice test again as you continue studying during your available access period.
After your access is confirmed, you can continue into the complete practice exam from this quiz flow.
Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.
Keep studying

Related Questions