ATT&CK Threat Hunting exam-day guide
ATT&CK Threat Hunting · Prepare for the day ahead.
Your checklist
Confirm exam delivery format and proctoring requirements with the provider
ATT&CK Threat Hunting is delivered by MITRE Engenuity as part of its adversary emulation training program. Before you build a study plan, confirm with the provider: whether the exam is online-proctored or in-person, whether webcam and microphone are required, whether a system check must be run in advance, and what the retake policy is. Do not assume a format based on other certification exams; policies change and only the provider's current handbook is authoritative.
Government-issued photo ID matching your registration name
Use a passport, driver's license, or national ID whose name matches your registration exactly. If your registration uses a shortened or alternate name, contact the provider in advance to correct it; mismatches are a common cause of denied entry. needs_review: exact accepted ID types and whether a second form of ID is required should be confirmed with the provider.
Stable internet connection and a backup plan
For remote-proctored delivery, test your connection at the same time of day as your appointment. Have a phone hotspot or a second location available as a fallback. Wired ethernet is more reliable than Wi-Fi. If the connection drops mid-exam, the proctor's reconnect process applies, so know it before test day.
Working webcam, microphone, and speakers on the test machine
Remote proctoring typically requires a live camera view of you and your room, audio for the proctor to communicate, and a screen share. Test all three in advance. Headphones are often restricted; confirm with the provider whether they are allowed. Keep the machine charged and plugged in.
Clean, private, well-lit room with a closed door
Clear your desk of papers, phones, smartwatches, and second screens unless the provider explicitly permits them. Notify household members of your exam window so they do not enter. A whiteboard or scratch paper is often prohibited in proctored exams; confirm the permitted-aids list with the provider rather than assuming.
Review the ATT&CK knowledge domains, not just tool screens
The exam targets practical threat hunting grounded in MITRE ATT&CK. Be fluent in: tactic and technique structure and IDs, the difference between techniques and sub-techniques, procedure examples, software and group pages, mitigations and detections mappings, and data sources and components. You should be able to move from a described adversary behavior to the right tactic and technique without browsing.
Practice navigating the ATT&CK knowledge base and the MITRE ATT&CK Evaluations material
Know how to find a technique by ID (for example T1059) and by name, how to read the detection and mitigation mappings on a technique page, and how the Evaluations results are structured. If the exam permits an open browser to reference ATT&CK, practice doing so quickly; if it does not, practice recalling the structure from memory. Confirm the open-book policy with the provider.
Rehearse the hunting workflow end to end
Practice the cycle: intake a hypothesis or threat intelligence lead, map it to ATT&CK techniques, identify the data sources needed (process creation, command-line, network, authentication, registry), write a detection logic sketch, and describe validation and false-positive handling. Be ready to explain why a data source is necessary and what gaps exist if it is missing.
Prepare for scenario and applied-reasoning items
Expect questions framed around an environment or an adversary report rather than pure definitions. Practice reading a short scenario, extracting the observable behavior, and selecting the technique, the required telemetry, or the next investigative step. Time-box yourself so you can judge pacing.
Know your time budget and question format
Confirm with the provider the number of items, time limit, and whether question review or flagging is available. In the final week, take at least one timed practice run under exam-like conditions and record how long you spend per item so you can set a per-question ceiling.
Plan logistics: arrival time, check-in buffer, and a quiet backup location
For in-person delivery, arrive early enough for ID check and security screening. For remote delivery, log in at the time the provider instructs, not later, and allow 15 to 30 minutes for check-in. Identify a backup room in case your primary space fails the proctor's room scan.
Confirm scoring, pass mark, and result reporting with the provider
needs_review: the passing score, score report format, and whether partial credit applies to multi-select items are provider-specific and may change. Do not rely on forum claims. Check the current candidate handbook and, if unclear, ask the provider directly before test day.
Plan the day
Stop learning new tools. Do a structured review of ATT&CK tactics in order (Reconnaissance through Impact) and, for each, list the three to five techniques you would most expect in a hunt scenario and the data source each requires. Re-read your own notes on technique IDs you keep confusing; write them out by hand once. Confirm your appointment time, time zone, and delivery format in the provider's portal, and re-read the candidate handbook for permitted aids and ID rules.
Run one full timed practice set under exam-like conditions: same desk, same machine, no phone, same time of day as your appointment. Afterward, review every miss and classify it as a knowledge gap (you did not know the technique) or a reading gap (you misread the scenario). Reading gaps are fixed by slowing down on the stem; knowledge gaps get a targeted 30-minute review each. Do not start a new study resource this late.
Do a technical systems check: webcam, microphone, speakers, browser, and internet stability. Clear your desk and set up the room as it will be on exam day. Charge and plug in your laptop. Print or write down the provider's support contact and your appointment confirmation. Do a light review only: technique ID flashcards, the tactic flow, and the hunting workflow. Aim for a normal night of sleep rather than a late cram session.
Confirm the appointment one final time and check for any provider email about rescheduling or system maintenance. Prepare your ID and place it on the desk. Decide what you will eat and drink beforehand and avoid heavy caffeine. Do one short, confidence-building review of the areas you know well, then stop. Set two alarms. If you feel a specific gap is serious, note it and plan a post-exam study item rather than trying to close it overnight.
Eat a normal meal and hydrate. Log in early, run any required system check, and complete the room scan calmly. Close every other application, silence your phone and put it out of reach, and remove smartwatches. Have your ID ready and your support contact visible. Do not review new material in the last hour; if you review at all, skim only your own one-page summary of technique IDs and the hunting workflow.
Read each stem fully before looking at the options. Identify the observable behavior and the question being asked (which technique, which data source, which next step). Answer confident items and flag anything that needs more than your per-question time ceiling. Do not let one scenario consume several questions' worth of time.
Return to flagged items. For scenario questions, restate the behavior in ATT&CK terms before choosing. Eliminate options that name the wrong tactic or a technique that does not match the described telemetry. Watch for distractors that are real techniques but wrong for the stated data source or adversary goal. If two options remain, choose the one that matches the observable evidence most directly.
Check that no item is left blank unless the provider penalizes guessing, which you should confirm in advance. Submit within the time limit. Note any technical issues and report them to the proctor before closing the session. Afterward, write down the topics you found hardest while they are fresh; that list becomes your study plan if a retake is needed or for your next hunting engagement.
Rules to check
Bring valid government-issued photo ID with a name matching your registration exactly. If the name differs, resolve it with the provider before test day; do not attempt check-in with mismatched documents.
Follow the provider's permitted-aids list precisely. Unless the provider explicitly allows notes, scratch paper, a second monitor, or browser access to ATT&CK, treat them as prohibited. When in doubt, ask the provider in advance rather than risk an integrity finding.
No phones, smartwatches, headphones, or other devices in the testing area unless the provider approves them. Silence and stow them out of reach. During remote proctoring, remain in camera view and do not leave the room without the proctor's permission.
Breaks: confirm with the provider whether scheduled or unscheduled breaks are allowed and whether the clock stops. Do not assume a break pauses your time. If you need to leave for an emergency, notify the proctor first and follow their instructions.
Do not communicate with anyone other than the proctor during the exam, and do not discuss, photograph, or reproduce exam content afterward. Sharing actual exam items violates the provider's terms and can void your result.
Scoring and pass marks are set by the provider and may change. Confirm the current passing standard, whether multi-select items require all correct choices, and whether unanswered items are penalized. Do not rely on third-party claims about the pass score.
If a technical failure occurs, stop and contact the proctor or provider support immediately and note the time. Do not attempt to troubleshoot in a way that takes you out of camera view without telling the proctor; documented issues are easier to resolve than undocumented ones.
Arrive or log in at the time the provider instructs. Late arrival may forfeit your appointment depending on provider policy, which you should confirm in advance rather than assume.