OSEP exam-day guide
OSEP · Prepare for the day ahead.
Your checklist
Government-issued photo ID
The proctor will verify your identity before the timer starts. Confirm with the provider which ID types are accepted (passport vs. national ID vs. driver's license) and that the name matches your registration exactly - a mismatch can delay or void your attempt.
Exam access email / portal credentials
Locate the confirmation email containing your exam start time, portal link, VPN connection pack, and proctoring instructions. Log in to the portal at least a day early to confirm the credentials still work.
Wired internet connection plus a backup link
Ethernet is strongly preferred over Wi-Fi for a 48-hour proctored session. Have a phone hotspot or second connection ready and know how to switch to it. Test the VPN connection end to end before exam day.
Webcam, microphone, and proctoring client installed and tested
Run the provider's system/proctoring check in advance so driver or permission issues surface early. Confirm the camera can show your face and the room on request.
Laptop, power adapter, and spare peripherals
Bring a spare mouse, keyboard cable, and if possible a second machine or a bootable backup. Assume you will be at the desk for long stretches - cable management and a stable power supply matter more than raw hardware.
Your own notes, cheat sheets, and payload/tooling references
Prepare searchable local notes: privilege escalation checklists, AD attack paths, AV-bypass and lateral-movement commands, and tool syntax. Confirm with the provider what reference material is permitted during the exam before relying on it.
Working attack VM with all tools validated offline
Snapshot your VM before the exam. Verify every tool you plan to use launches without network updates, that shared folders/clipboard work, and that you can revert a broken snapshot in minutes.
Report template and screenshot folder structure ready
Create a document skeleton with headings for each target, an evidence folder per machine, and a naming convention for screenshots. Time spent structuring evidence during the exam is time you do not have to spend in the reporting window.
Screenshot and note-taking workflow
Pick one screenshot tool and one notes file and use them consistently. Capture the command, the output, and the resulting shell in the same shot - this is what makes the report defensible later.
Quiet, isolated room with a door you can close
Proctored exams generally require you to be alone with no other people entering the frame and no second screens visible unless approved. Clear the desk of anything not exam-related and silence phones.
Hydration, food, and a rest plan
Stock water and easy food near the desk. Plan short sleep blocks in advance; a 48-hour clock does not pause for you, so decide your sleep schedule before the timer starts rather than at hour 30.
Alarms and time-zone conversion for the start time
Convert the official start time to your local time zone in writing and set two alarms. Confirm the reporting deadline is measured from the end of the hands-on window, not from when you finish early.
Plan the day
Stop learning new material. Re-read your own notes and the course lab walkthroughs you found hardest. Rebuild and snapshot your attack VM, verify every tool works offline, and rehearse the full workflow end to end on a lab machine so nothing is unfamiliar on exam day.
Set up the report template and the evidence folder structure, and write one practice report page from an old lab exercise so the format is muscle memory. Confirm with the provider the exact submission mechanism and accepted file format.
Shift your sleep schedule toward the exam window if it starts unusually early or late for you. Confirm the proctoring check passes on the machine you will actually use, and read the provider's exam policy page once more so no rule surprises you mid-attempt.
Do a full dress rehearsal: proctoring client launch, VPN connect, tool launch, screenshot, note-taking. Charge everything, pack spares, and clear the desk. Confirm start time in your local time zone and the reporting deadline. Sleep a full night - do not trade sleep for last-minute studying.
Eat, hydrate, and start the proctoring/identity check early. Have your ID, portal credentials, and VPN pack open before the scheduled time. Close every non-essential application, disable notifications, and start your notes file and screenshot folder before the timer begins.
Read the entire scenario and enumerate every target and objective before touching a keyboard. Write a short plan with rough time budgets per target, then start with the target you assess as highest confidence rather than the highest points.
Document as you go, not afterwards: command, output, shell, and a one-line explanation for each step. Take a VM snapshot at every stable foothold. Keep a running log of what you tried and failed on each host so you never re-tread the same ground, and track the clock against your budget.
When a target stalls past its budget, park it, capture what you learned, and move on. Return later with fresh eyes. Leave a clear margin near the end of the window for verification - re-confirm your evidence proves each claimed objective.
Write the report inside the submission window, starting with the objectives you are most confident about. Include reproducible steps and screenshots for every claim, then proofread for completeness against your own objective checklist. Submit through the official channel well before the deadline; confirm the submission was acknowledged.
Rules to check
You must be alone in a controlled room for the duration; the session is proctored via webcam and screen sharing. Other people, off-camera screens, or unauthorized devices in view can end your attempt - confirm the provider's specific device and room rules in advance.
Identity is verified against your registration before the exam begins. Confirm with the provider which documents are accepted; a name mismatch or missing ID may forfeit the attempt.
Work must be your own. Do not receive help from another person, share exam content, or discuss the exam with anyone during or after the attempt - exam material is confidential under the provider's agreement.
Internet use during the exam is for technical reference only. Confirm with the provider exactly what is allowed (public documentation and CVE lookups versus forums, chat, or AI assistants) before you rely on it.
The hands-on clock runs continuously and does not pause for breaks, sleep, or technical problems on your side. Manage your own rest within the window.
The report must be submitted within the stated window after the hands-on period ends, and a late report is treated as a failed attempt. Confirm the exact window and submission channel with the provider.
A minimum score must be reached to pass, with the pass mark and points distribution set by the provider. Confirm the current scoring threshold and breakdown rather than relying on secondhand accounts.
Exam attempts included with a course purchase and the cost and rules for retakes are set by the provider. Confirm your included attempts and any retake pricing before exam day.