HTB CWEE exam-day guide
HTB CWEE · Prepare for the day ahead.
Your checklist
Government-issued photo ID matching your registration name
Your name on the ID must match the account and registration exactly. If you have any doubt about whether a specific document is accepted (passport vs. national ID, name variants, expiry), confirm with the provider before exam day rather than assuming.
Working webcam and microphone
Most remote proctored exams require a live identity check and room scan. Test both devices in the browser or proctoring client you will actually use, not just in the OS settings. Confirm the exact hardware requirements with the provider, as they can change.
Stable wired-or-strong internet connection plus a backup
Plan a fallback: a mobile hotspot or a second network you can tether to. Know in advance what happens to your timer if the connection drops - this is provider-specific, so confirm with the provider.
Compatible browser and any required proctoring client pre-installed
Install and launch the proctoring software at least a day early so you can clear permission prompts, antivirus conflicts, and updates. Verify the supported browser version with the provider.
Your own attack environment prepared and snapshotted
A VM or host you control with your usual tooling installed and a clean snapshot to roll back to. Do not rely on downloading tools mid-exam if the network is restricted - test that package installs and tool downloads work under exam conditions.
A tested VPN/tunnel or jump setup for reaching lab targets
If the exam provides connectivity instructions (VPN profile, credentials, target scope), download and test them beforehand if the provider allows pre-exam access. If you only get them at start time, have your client software ready and know the connect command by heart.
Notes, methodology sheets, and command cheatsheets allowed by the rules
Prepare concise, searchable notes: enumeration checklists, common exploit syntax, privilege-escalation steps for Windows and Linux, and Active Directory attack paths. Confirm what reference material is permitted - the exact rules on notes and open-internet access are provider-specific.
A written plan for flag/report submission and time budgeting
Know the submission format, whether partial credit exists, and how the passing threshold is defined. Confirm scoring details and any report requirements with the provider; do not assume how flags or objectives map to points.
Quiet, private room with a clear desk
Remove secondary screens, phones, and notes that are not permitted from the camera's view unless the rules allow them. A cluttered or shared space can trigger a proctor interruption.
Water, snacks, and a plan for breaks
Long practical exams are endurance events. Check the break policy ahead of time - whether the clock keeps running and whether you must notify the proctor. Confirm break rules with the provider.
Time-zone-converted start time and login credentials verified
Convert the scheduled start to your local time, set two alarms, and log in early to complete identity checks and setup. Keep the provider's support contact handy in case of access problems.
A backup machine or recovery plan
If your primary machine fails, know whether you can switch devices and how that affects the timer and proctoring session. This is provider-specific - confirm the policy before exam day.
Plan the day
Shift from learning to rehearsal. Re-read the exam objectives and confirm your weak areas are covered by notes, not by new study. Do a full dry run of your environment: boot the VM, connect to a practice target, run your enumeration workflow end to end, and verify your tooling installs and runs. Test the proctoring client and webcam/mic. Re-read the candidate handbook for rules on notes, internet use, breaks, and scoring, and send any clarifying questions to the provider now so answers arrive before exam day. Sleep on a normal schedule starting tonight.
Stop heavy studying. Review only your own methodology sheets and cheatsheets. Confirm logistics: start time in local time, ID ready, room arranged, network backup tested, water and snacks purchased. Charge devices and update the OS and tools now, not tomorrow. Close out work and personal commitments so you are not distracted. Get a full night's sleep; do not pull an all-nighter cramming.
Eat a real meal and hydrate. Set up your workspace: clear desk, camera angle, secondary devices away. Launch the proctoring client early and complete identity verification and room scan with time to spare. Open your notes and environment, confirm VPN/target connectivity if credentials are already available, and start a scratch file for notes, credentials found, and target IPs. Log in before the scheduled start so technical issues do not eat exam time.
Read the full scope and objectives first, then budget time across targets and write it down. Start with broad enumeration on every in-scope host before deep-diving one - early footholds often unlock later stages. Log everything as you go: commands, credentials, hashes, and paths, so you can write up findings and recover if you lose a session. Snapshot your VM before risky steps. If you get stuck, timebox it, move to another target, and return with fresh eyes. Watch the clock and reserve the final portion for verifying submissions and completing any required report. Take the breaks the rules allow to stay sharp.
Rules to check
Bring government-issued photo ID matching your registered name; if you are unsure which documents are accepted, confirm with the provider before exam day.
Follow the proctoring and environment rules exactly - room scan, camera on, permitted materials only. If a rule is unclear, ask the provider in advance rather than guessing mid-exam.
Do not communicate with anyone other than the proctor during the exam, and do not use unauthorized assistance, tools, or shared machines. Violations can void your result.
Confirm the break policy with the provider: whether the timer runs during breaks, whether you must notify the proctor, and what you may access while away.
Confirm the scoring model and passing threshold with the provider, including whether partial credit exists and whether a written report is required in addition to captured flags.
Stay within the defined target scope; do not attack infrastructure outside the authorized range, and treat all exam artifacts as confidential.
Report technical problems to the proctor or provider support immediately and document them; do not attempt to fix proctoring issues by restarting without guidance if the rules prohibit it.
Keep your environment and notes self-contained and recoverable - snapshot before risky actions - so a crash or lost session does not cost you the attempt.