CWE exam-day guide
CWE · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Bring the original, unexpired ID in the exact name used on your registration. For remote proctoring, have it ready to hold up to the camera. Confirm with the provider which ID types it accepts and whether a secondary ID is required.
Exam appointment confirmation
Have your confirmation email, registration number, and the provider's support phone number accessible. For a test center, note the address and arrival time; for remote delivery, note the platform link and system-check instructions.
Know your exam code and title
The CWE exam is delivered through a certification provider, and the exact code, version, and number of scored items are set by that provider. Verify these details on your confirmation and on the provider's current candidate handbook before test day.
Review the current candidate handbook
Read the provider's handbook for time limits, item formats, scoring, retake policy, and any non-disclosure agreement you must accept. Policies change; rely on the version in effect for your appointment, and confirm anything unclear with the provider.
Confirm the allowed reference or open-book policy
Some provider-delivered exams allow specified references or are open-book. Do not assume this for CWE. Confirm with the provider exactly what materials, notes, or tabs are permitted, and whether a printed reference is allowed at a test center.
Remote-proctoring system check
If testing online, run the provider's equipment and compatibility check in advance: camera, microphone, browser, bandwidth, and a quiet private room. Confirm the room and desk rules with the provider. needs_review: specific hardware and room requirements vary by provider and must be confirmed.
Arrival and check-in timing
Plan to arrive or log in earlier than your start time to allow for ID checks and security screening. The exact required lead time is set by the provider; confirm it rather than guessing.
Practice the question formats
Be ready for scenario-based items that may include multiple-choice, multiple-response, or short written responses, depending on the provider's format. Read each item fully and note whether it asks for one answer or all that apply.
Time-management plan
Note the total time and item count from your confirmation, then plan a per-item pace with a buffer for review. If the provider publishes the number of scored items, use that number; otherwise plan conservatively and confirm with the provider.
Personal comfort items within the rules
Water, tissues, and similar items may be restricted at test centers or during proctored sessions. Check the provider's allowed-items list before bringing anything; when in doubt, leave it behind or confirm with the provider.
Rest and logistics the night before
Confirm travel time, parking or transit, and a backup plan for connection or transport problems. Sleep on a normal schedule rather than cramming new material late.
Emergency contact plan
Save the provider's support number in case of a platform failure, power outage, or late arrival. Know whether and how the provider reschedules or reopens a disrupted session; confirm this in advance.
Plan the day
Stop expanding your scope. Review your own summary notes on web exploitation fundamentals: injection classes and their mitigations, authentication and session weaknesses, access-control failures, cross-site scripting and request forgery, insecure deserialization, and server-side request forgery. Re-read the provider's candidate handbook for format, timing, and rules. Run the remote-proctoring system check if applicable, and confirm your appointment details and ID name match.
Do timed practice under exam-like conditions using original practice material, not recalled items. Focus on reading scenario prompts carefully and identifying what the question actually asks. Note where you lose time and adjust your per-item pace. Avoid memorizing question wording; build reasoning you can apply to unfamiliar scenarios.
Light review only: skim your notes on vulnerability identification, impact, and remediation trade-offs. Prepare your ID, confirmation, and any permitted items. Confirm the start time, location or link, and travel or connection plan. Set alarms. Get a full night's sleep; do not start a new topic the night before.
Eat normally, hydrate, and arrive or log in early per the provider's instructions. Complete ID verification and accept any non-disclosure agreement. Close unrelated applications and notifications for remote delivery. Take a few minutes to settle before the timer starts.
Read each item completely before answering, and watch for qualifiers such as 'best', 'most likely', or 'all that apply'. Answer what you know first and flag uncertain items for review if the platform allows. For scenario items, identify the vulnerability class, the evidence in the prompt, and the most appropriate mitigation. Keep an eye on the clock and reserve time for flagged items.
If a technical problem occurs, stop and contact the proctor or provider support immediately rather than improvising. If you finish early, use remaining time to check flagged items and confirm you have answered every required part. Do not attempt to record, copy, or share exam content.
Note your result and any score report details the provider gives. If you did not pass, review the provider's retake policy and any score breakdown before scheduling again. Confirm waiting periods and fees with the provider.
Rules to check
Bring the original government-issued photo ID in the exact name on your registration. Confirm accepted ID types and any secondary ID requirement with the provider before test day.
Follow the provider's rules on permitted materials, notes, and devices. Do not assume the exam is open-book; confirm what is allowed, and leave anything unconfirmed at home or outside the testing area.
Do not record, copy, photograph, or share exam content, and do not discuss specific items afterward. Accept and follow any non-disclosure agreement the provider presents.
Breaks are governed by the provider's policy and may be limited or unavailable during a timed session. Confirm the break rules in advance, and note that unscheduled breaks may not stop the clock.
Scoring, passing thresholds, and any partial-credit treatment are set by the provider. Do not rely on secondhand claims about cut scores; check the current handbook and confirm with the provider.
If you need accommodations, request them through the provider's process well before your appointment. Approval and deadlines vary, so confirm the procedure rather than assuming it will be handled on test day.
Report technical failures, interruptions, or rule questions to the proctor or provider support immediately. Do not attempt to resolve platform problems by yourself, and keep any case or ticket number.
Arrive or log in by the provider's stated time. Late arrival may lead to forfeiture of the appointment or fee; confirm the exact cutoff and rescheduling policy with the provider.