eWPT exam-day guide
eWPT · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Bring the original ID whose name matches your registration exactly. If your registration name differs even slightly (middle name, hyphenation), confirm with the provider in advance how to correct it, since mismatches can block entry.
Exam appointment confirmation and provider instructions
Keep the confirmation email and the provider's candidate handbook accessible offline. It contains the current rules on scheduling, rescheduling, and what is permitted during the session; policies change, so rely on the version sent with your booking, not older forum posts.
Reliable computer and stable network (remote delivery)
If you sit the exam remotely, use a wired or strong connection, close bandwidth-heavy applications, and run any system or browser check the provider offers ahead of time. Confirm with the provider whether remote proctoring is available for your booking, as delivery options vary.
Webcam and microphone working
Remote proctoring typically requires a functioning webcam and microphone for identity verification and room checks. Test both the day before. Confirm with the provider the exact hardware and room requirements for your session.
Clean, quiet, private room
Clear your desk of notes, phones, and second screens. Proctors commonly require a 360-degree room scan and may object to mirrors, posters with text, or other people entering. Confirm the permitted items with the provider before test day.
Your own methodology notes or cheat sheets, if permitted
Some practical web-pentest exams allow reference material; others forbid it. Confirm with the provider whether notes, documentation tabs, or search engines are allowed during the practical portion. Do not assume either way.
Attack machine and tooling prepared
If the exam provides a lab environment and lets you use your own tools, verify your preferred proxy, browser, and scripting setup work before the clock starts. If the provider supplies a fixed VM, read its access instructions in advance so you do not lose time learning the environment.
Report template and time budget plan
Practical exams usually require a written report after exploitation. Prepare a skeleton (findings, evidence, reproduction steps, remediation) and decide in advance how much time to reserve for writing. Confirm the required report format and submission method with the provider.
Time zone and start-time double check
Convert the scheduled start into your local time and set two alarms. Scheduling windows and time-zone handling are provider-specific, so verify the exact start time in your confirmation rather than relying on memory.
Backup power and connectivity plan
Charge your laptop, have a charger within reach, and know how you would reconnect if the network drops. Ask the provider in advance what happens to your time if a technical failure occurs.
Provider contact details for technical issues
Save the support phone number or chat link for exam-day technical problems. Confirm with the provider which channel is monitored during your session and its response expectations.
Water, snacks, and a clock within view
Long practical sessions are draining. Keep water nearby if allowed, and place a visible clock or timer so you can track milestones without relying on the exam platform's display. Confirm whether food and drink are permitted in the testing room.
Plan the day
Re-read the provider's candidate handbook and your booking confirmation, and confirm the exact start time in your local zone. Verify the delivery mode (remote proctored or test center), the allowed materials, and the report submission requirements. Resolve any name or ID mismatch now, not on exam day.
Do a final technical rehearsal: log in to any practice or sample environment the provider offers, confirm your proxy and browser tooling behave, and test your webcam, microphone, and network. Fix problems while you still have time to contact support.
Run one timed dry run of your methodology on a practice target you set up yourself. Focus on the workflow you will follow under pressure: enumeration, prioritization, evidence capture, and writing up findings. Stop studying new topics; consolidate what you already know.
Prepare your workspace: clear the desk, remove notes and devices that are not permitted, and set up your camera angle. Charge devices, gather your ID and confirmation email, and save the provider's support contact. Prepare your report template so it is ready to fill in.
Write a one-page attack plan: the order you will enumerate hosts and services, how you will record evidence as you go, and your time checkpoints. Decide how many minutes you will reserve for reporting and stick to that number. Get a full night's sleep rather than cramming.
Eat properly, hydrate, and avoid starting anything that could run past your check-in window. Log in early per the provider's instructions, complete any identity verification and room scan, and keep your ID visible. Have your support contact open in case of technical trouble.
Spend the first few minutes reading the instructions and confirming the environment works. Then follow your enumeration plan methodically rather than jumping between targets. Capture screenshots and command output as you exploit, because reconstructing evidence afterward wastes time.
Watch your time checkpoints. When you reach the point you reserved for reporting, stop exploiting and start writing, even if a target remains unfinished. A clear, well-evidenced report on the findings you have usually scores better than an incomplete report on more findings.
Before submitting, verify the report covers each finding with reproduction steps, impact, and remediation, and that all required files are uploaded in the specified format. Confirm submission was accepted, then log out and note anything the provider asks you to retain.
Rules to check
Follow the provider's current candidate agreement exactly. Rules on permitted tools, notes, internet access, and communication differ between exams and can change, so confirm the version that applies to your booking rather than relying on secondhand accounts.
Present the original photo ID used at registration. If your name, spelling, or document type does not match, contact the provider before exam day to resolve it; entry may otherwise be refused.
Do not communicate with other people during the session, and do not share, record, or publish exam content, targets, or questions. Treat the lab environment and any exam materials as confidential per the provider's terms.
Only test the systems and scope the exam provides. Do not attack the proctoring platform, the provider's infrastructure, or any host outside the stated target range, even if it appears reachable.
If you need a break, follow the provider's stated policy. Many proctored exams restrict leaving the camera view or the room, and unsanctioned breaks may be flagged; confirm the break rules for your session in advance.
If a technical failure occurs, stop and contact the provider's support channel rather than improvising. Ask in advance how lost time is handled, since compensation policies are provider-specific.
Understand how your exam is scored before you sit it: confirm whether passing requires both a practical compromise component and a written report, and what minimum is needed for each. Do not assume a single overall threshold.
Submit your report and any required evidence through the specified channel by the deadline. Late or malformed submissions may not be accepted, so confirm the format and cutoff with the provider and keep a copy of your submission confirmation.