HTB CPTS exam-day guide
HTB CPTS · Prepare for the day ahead.
Your checklist
Stable internet connection with a tested backup
The CPTS exam is delivered remotely and you will work in a lab environment for a long session, so connectivity is critical. Test your primary connection the day before, and have a fallback ready (mobile hotspot or tethering with sufficient data). Run a short video call or large file transfer to confirm upload and download speeds, not just browsing.
Working VPN client and credentials
Access to the exam lab typically goes through a VPN. Install the client in advance, import any provided profile, and confirm you can connect before exam day. If your setup uses a specific client version, confirm the supported version with the provider rather than assuming.
Kali Linux (or equivalent) attack VM, updated and snapshotted
Use a VM you know well. Update tools a few days before, take a snapshot you can revert to, and verify the core toolchain works: nmap, a web proxy such as Burp Suite, an SMB/AD toolset, and a note-taking app. Avoid updating tools on exam morning, since a broken dependency mid-engagement costs time.
Note-taking and reporting template ready
You will need to document findings, commands, credentials, and screenshots as you go, because the final deliverable is a report. Prepare a structured template (hosts, services, credentials, exploitation steps, evidence) before the exam so you capture evidence in real time instead of reconstructing it afterward.
Screenshot and evidence-capture habit/tool configured
Set up a screenshot tool with a hotkey and a dedicated evidence folder. Capture proof of each flag or objective and the command or request that produced it. Evidence taken at the moment of exploitation is far more reliable than memory.
Government-issued photo ID
Most proctored exams require identity verification. Have a valid photo ID ready and confirm in advance which forms of ID the provider accepts and whether the name must match your registration exactly.
Quiet, private room and a clean desk
Proctoring typically requires a private space free of notes, other screens, or people. Clear your desk, close other applications, and tell household members not to enter. Confirm the provider's specific room and camera requirements beforehand.
Exam booking confirmation and access instructions
Locate the email with your exam link, lab access details, and any token or voucher. Save it offline (screenshot or PDF) in case webmail is unavailable during the session. Confirm the start time in your local time zone.
Water, snacks, and a plan for breaks
This is a long practical session. Keep water and easy food at your desk, and plan short breaks. Confirm with the provider whether you may leave the camera view during the exam and how breaks affect your time.
Backup power and hardware check
Charge your laptop, keep the charger plugged in, and test that your machine can run your VM with adequate RAM and disk. A laptop that thermally throttles or runs out of disk mid-exam is a common avoidable failure.
Read the exam rules and scoring documentation
Review the provider's current exam guide for scope, allowed tools, flag/objective submission, and reporting requirements. Policies change, so read the version issued with your booking rather than relying on older write-ups.
Time-boxing strategy written down
Decide in advance how long you will spend on a stuck objective before moving on. Write the rule down and follow it; a practical exam rewards breadth of completed objectives over perfection on one host.
Plan the day
Do light consolidation only: review your own notes on enumeration, Active Directory attack paths, and web exploitation. Do not start a new course or tool. Update and snapshot your VM, test the VPN, verify your ID and booking email, and prepare your report template and evidence folder. Sleep on a normal schedule.
Confirm the exam start time in your local zone, re-read the provider's exam rules for scope and submission, and check that your lab access instructions are saved offline. Do a final connectivity and tool smoke test, then stop technical study. Prepare your desk, charge devices, and get a full night's sleep.
Eat properly, hydrate, and set up the room and camera early. Launch your VM and confirm the VPN connects before the scheduled start. Keep the booking email and ID within reach. Join the session a few minutes early if the provider allows it, and avoid last-minute updates or installs.
Read the full set of objectives and scope before attacking anything. Sketch a plan and an ordered target list, set up your notes and evidence folder, and confirm the flag/objective submission mechanism works with a low-risk item if permitted. Start with the objective you are most confident about to build momentum.
Work in cycles: enumerate thoroughly, exploit, capture evidence, then move on. Log every command and credential as you go. Apply your time-box rule strictly, and revisit stuck objectives only after sweeping the easier ones. Watch the clock and reserve enough time at the end to verify submissions and assemble the report.
Stop starting new attack paths with little time left. Verify that every claimed objective has evidence and has been submitted correctly, then finish or submit the report per the provider's requirements. Confirm the submission was received before the session closes.
Rules to check
Bring valid government-issued photo ID and ensure the name matches your registration; confirm accepted ID types with the provider before exam day.
Work only within the scope defined by the exam instructions. Do not attack infrastructure, other candidates, or systems outside the provided lab, even if reachable.
Do not use unauthorized assistance: no other people, no AI or automated solvers, and no outside hints during the exam unless the provider explicitly permits them. Confirm the allowed-tools list with the provider.
Follow the proctoring rules on camera, screen sharing, room privacy, and breaks. If you must leave the camera view, confirm in advance how the provider wants you to handle it.
Document as you go. Objectives and flags must be supported by evidence and submitted through the mechanism the provider specifies; confirm the submission format and any reporting requirement.
Do not share, publish, or discuss live exam content, flags, or lab details. Respect any non-disclosure terms in the provider's agreement.
If something breaks (connectivity, lab access, proctoring), contact the proctor or provider support immediately and note the time; do not attempt to troubleshoot silently for a long period.
Confirm scoring, pass criteria, and any retake policy directly with the provider, since these are set by the provider and can change.