MITRE ATT&CK Fundamentals exam-day guide
MITRE ATT&CK Fundamentals · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Bring the exact ID the registration name matches. Confirm with the provider which forms of ID are accepted and whether a secondary ID is required; do not assume a student card or expired document will pass.
Provider account credentials and exam appointment confirmation
Know your login for the testing platform and have the appointment confirmation (email or PDF) accessible. If your exam is delivered through a proctoring vendor, confirm with the provider whether you log in through the vendor portal or the certification body's site.
Confirmed delivery mode and system requirements
Decide well ahead whether you are testing at a test center or online with remote proctoring. For online delivery, run the vendor's system check on the actual machine and network you will use. Confirm with the provider the minimum bandwidth, OS, browser, and webcam/microphone requirements.
Quiet, private room and desk cleared (online delivery)
Remote proctoring typically requires a private room, a clear desk, no second monitors, and no notes or devices within reach unless explicitly permitted. Confirm with the provider the exact room and desk rules, including whether a whiteboard or scratch paper is allowed and how it must be shown and erased.
Stable internet connection plus a backup plan
Prefer wired Ethernet or a strong, dedicated connection. Have a phone with a hotspot as backup and know the vendor's reconnect procedure. Confirm with the provider what happens to your timer and answers if the connection drops mid-exam.
Study plan anchored to the ATT&CK knowledge domains, not memorization
The exam tests applied understanding: the structure of the ATT&CK matrix (tactics as columns, techniques as rows), tactic ordering and meaning, technique and sub-technique relationships, procedure examples, mitigations, detections, groups and software, and how to map observed behavior to techniques. Build your final review around these domains rather than trivia.
Practice with the official ATT&CK knowledge base and Navigator
Be fluent in browsing tactics, techniques, sub-techniques, and the detection/mitigation mappings on the ATT&CK site, and in using ATT&CK Navigator layers. Confirm with the provider whether any reference material is permitted during the exam; assume it is not unless stated.
Logistics confirmed: time zone, check-in time, duration, format
Confirm the appointment time in your local time zone, how early to check in, total seat time, number of questions, question formats (multiple choice, multiple select, scenario-based), and pass score. These vary by provider and version, so confirm with the provider rather than relying on forum posts.
Retake, rescheduling, and refund policy understood
Read the provider's policy on rescheduling deadlines, no-show fees, retake waiting periods, and score reporting. Confirm with the provider if anything is unclear before the final 72 hours, when changes may no longer be possible.
Accessibility or accommodation requests already filed
If you need extra time, a screen reader, or other accommodations, these usually require advance approval. Confirm with the provider the deadline and approval status; last-minute requests are commonly refused.
Water, medication, and break expectations checked (needs_review)
Rules on drinks, medication, and scheduled versus unscheduled breaks differ by vendor and delivery mode. Confirm with the provider whether breaks are allowed, whether the clock stops, and whether you must remain on camera.
Plan for results and next steps
Know how and when your score is delivered and what a passing result entitles you to (digital badge, certificate, continuing education credits). Confirm with the provider the credential's maintenance requirements.
Plan the day
Stop expanding scope. Re-read your own notes on the ATT&CK matrix structure: the order and intent of tactics from Reconnaissance through Impact, and how techniques and sub-techniques nest under them. Do targeted self-quizzing on mapping short behavioral descriptions to the correct tactic and technique, since scenario questions reward that skill. Review the difference between tactics (the why/goal) and techniques (the how), and between techniques and procedures. Skim mitigations and detections for techniques you keep confusing. Verify all logistics: appointment time in your time zone, ID, delivery mode, and system check. Resolve any open questions with the provider now, not later.
Do a light review only: a one-page summary of tactic names and definitions, a handful of technique families you found hardest, and the ATT&CK Navigator basics if relevant. Run the proctoring system test once more if testing online, and charge devices. Prepare your ID and confirmation in one place. Confirm the check-in time and how early to arrive or log in. Avoid cramming new material. Get a full night's sleep; sleep matters more than one more hour of review.
Eat a normal meal and hydrate. Set up your workspace: clear desk, close extra applications, silence notifications, and position the camera and microphone if remote. Join or arrive early per the provider's instructions. Have your ID ready for verification and be prepared for a room scan or environment check under remote proctoring. Do a short, calm warm-up: recite the tactic sequence once and remind yourself to read each scenario for the observed behavior before looking at the answer choices.
Read the full scenario before evaluating options; identify the adversary goal first (which tactic), then the specific behavior (which technique). Watch for multiple-select questions and answer exactly the number requested. Use the flag-and-review feature: answer what you know, mark uncertain items, and return to them if time allows. Manage the clock against the number of questions; do not let one hard item consume disproportionate time. If a technical issue occurs, pause and follow the proctor or vendor reconnect procedure rather than improvising, and note the time so you can report it.
Rules to check
Bring the ID that matches your registration exactly and present it when asked; if your name or document situation is unusual, confirm with the provider in advance how to handle it.
Follow all proctoring and environment rules for your delivery mode, including desk clearance, camera positioning, and any permitted materials; if a rule is unclear, confirm with the provider before the exam rather than guessing.
Do not use unauthorized notes, devices, second screens, or assistance from other people during the exam; treat any ambiguity about what is permitted as a question for the provider.
Ask the proctor or vendor support before acting if you need to leave the camera view, take an unscheduled break, or troubleshoot a technical problem; confirm with the provider how breaks affect the timer.
Respect the provider's policy on rescheduling, lateness, and no-shows; arriving late or missing check-in may forfeit your seat or fee, so confirm the cut-off with the provider.
Understand the scoring before you sit: number of questions, question formats, and pass score vary by provider and version, so confirm with the provider and do not rely on secondhand claims.
Keep exam content confidential: do not record, screenshot, or share questions or scenarios afterward, per the provider's confidentiality agreement.
If you believe a question is flawed or the environment caused a problem, report it through the provider's official channel promptly and keep any reference numbers they give you.