OffSec Threat Hunter exam-day guide
OffSec Threat Hunter · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Bring the same ID used during registration. Confirm with the provider which ID types are accepted and whether a secondary ID is required.
Exam appointment confirmation and access instructions
Save the confirmation email and any proctoring links or portal credentials offline. Confirm with the provider the exact start window and how the exam session is launched.
Supported browser and proctoring software installed and tested
Install the required browser and any proctoring extension ahead of time, run the system check, and confirm webcam, microphone, and screen-sharing permissions work. Exact software requirements must be confirmed with the provider.
Stable wired or high-bandwidth internet with a backup
Test upload/download speed and latency. Have a mobile hotspot or secondary connection ready. Confirm with the provider whether switching networks mid-exam is permitted.
Quiet, private, well-lit room with a cleared desk
Remove papers, notes, second monitors, phones, and any unauthorized devices from the camera view. Confirm with the provider the room-scan and desk-clearance rules.
Power and charging
Charge the laptop fully and keep the charger connected. A power interruption should not end the attempt.
Note-taking method allowed by the exam platform
Threat hunting scenarios often need scratch notes, timelines, and IOC lists. Confirm with the provider whether physical paper, an on-screen notepad, or only the platform's built-in notes are allowed.
Personal tooling and reference policy understood
Know in advance whether you may use your own SIEM queries, scripts, or open-source references. Confirm with the provider what is considered authorized assistance versus prohibited material.
Water, snacks, and medication within reach
Place them off the desk or in a spot the proctor approves. Confirm with the provider whether food and drink are allowed at the workstation.
Break and timing plan written down
Know how many breaks are allowed, their maximum length, and whether the clock stops. Confirm with the provider the break policy and whether unscheduled breaks are permitted.
Support contact for technical or proctoring issues
Save the provider's exam support phone number or chat link. If the session fails, contact support immediately and document the time and error message.
Backup plan for connectivity or hardware failure
Know where you will relocate if the primary room or connection fails, and confirm with the provider how an interrupted attempt is resumed or reviewed.
Plan the day
Re-read the exam objectives and confirm the format, time limit, passing score, and permitted resources with the provider. Do not learn new tools; instead, rehearse your threat-hunting workflow end to end: hypothesis, data source selection, query, timeline correlation, IOC extraction, and written findings. Practice writing a concise incident narrative with evidence citations under time pressure. Prepare your environment: run the system check, install required software, test the webcam and microphone, and clear the exam room. Sleep on a normal schedule and avoid cramming new material in the last 48 hours.
Confirm the appointment time in your local time zone and set two alarms. Verify the ID, confirmation email, and support contact are accessible offline. Do a final 30-minute environment test and charge all devices. Prepare water, snacks, and any approved medication. Write a one-page timing plan: how many minutes for reading, investigation, and final write-up, plus when you will take breaks. Stop studying early, eat a normal meal, and get a full night's sleep. Avoid alcohol and heavy caffeine late in the day.
Eat a normal meal and hydrate. Log in early to complete identity verification and any proctoring setup, but do not start the exam until instructed. Close all unrelated applications and browser tabs, silence phone notifications, and put the phone out of reach as required. Do a final room scan and desk check. Keep your ID and support contact visible. Take a few minutes to write down your investigation checklist on approved scratch material before the clock starts, if permitted.
Read the full scenario and questions first, then allocate time proportionally to point value. Work from hypothesis to evidence: identify the data sources, run targeted queries, build a timeline, and record IOCs and affected hosts as you go. Do not chase every alert; prioritize scope, impact, and attacker progression. Save notes continuously and cite specific evidence in written answers. If a tool or query fails, note the error, switch to an alternate data source, and move on. Watch the clock and reserve the final portion for reviewing answers and completing the write-up. Take only approved breaks and log back in promptly.
Rules to check
Bring the exact government-issued photo ID used at registration and be ready for identity verification; confirm with the provider which ID types and names are accepted.
Keep the exam room private and cleared of unauthorized materials. Any room scan, desk-clearance, or camera-position requirement must be confirmed with the provider before exam day.
Do not use unauthorized tools, notes, communication devices, or assistance. Confirm with the provider what tooling, scripts, and reference material are permitted during the exam.
Follow the provider's break policy. Confirm in advance how many breaks are allowed, their maximum duration, whether the clock stops, and whether unscheduled breaks are permitted.
Do not discuss, share, or publish exam content, scenarios, or questions. Treat all exam material as confidential per the provider's terms.
If a technical or proctoring failure occurs, contact exam support immediately, document the time and error, and follow the provider's instructions rather than attempting to restart on your own.
Understand the scoring model before you start: confirm with the provider whether partial credit is awarded, how written answers are graded, and what the passing score is.
Report any suspected policy ambiguity or accommodation need to the provider before the exam; do not assume a rule will be waived during the session.