Exam Structure & Requirements
Seven days to prove how you operate.
Every Encrypted Syntax certification uses a remote, hands-on exam built around realistic objectives and a professional report. You are evaluated on technical judgment, evidence, impact, and communication—not memorized commands.
Know exactly what happens from activation to result.
Your seven-day window includes both technical work and report writing. Once activated, the clock runs continuously for 168 hours.
Activate
Receive access details, scope, objectives, and the official reporting requirements.
Operate
Work independently inside your dedicated environment and capture evidence as you progress.
Report
Convert technical work into a professional PDF with impact, evidence, and recommendations.
Submit
Deliver the report before the exam window closes for manual technical review.
The deliverable changes with the role.
Compromise exposed and internal systems, attack Active Directory, pivot through networks, escalate privileges, and prove business impact.
- Full penetration-test report
- Reproducible attack paths
- Evidence and remediation
Analyze alerts, logs, memory, disk, and network evidence; reconstruct attacker activity; contain the incident; and improve detections.
- Incident-response report
- Evidence-backed timeline
- Containment and hardening
Enumerate cloud identities and services, abuse misconfigurations and trust, escalate privileges, move laterally, and demonstrate exposure.
- Cloud assessment report
- Attack-path evidence
- Risk ratings and mitigation
Passing requires both execution and communication.
Technical Objectives
Your completed objectives, quality of evidence, methodical reasoning, command and tool understanding, and ability to demonstrate meaningful impact.
- Accurate scope handling
- Defensible screenshots, logs, and commands
- Understanding of how and why the result occurred
Professional Reporting
Your report structure, technical accuracy, reproducibility, stakeholder clarity, risk explanation, and practical remediation or hardening guidance.
- Clear executive communication
- Complete technical evidence
- Actionable recommendations
Prepare the environment before the clock starts.
Technical Setup
- Stable, reliable internet connection
- Modern Linux, Windows, or macOS system
- Ability to use the supplied VPN client
- Hardware capable of running your tools and optional local VMs
Preparation Materials
- Your own notes, cheat sheets, and mind maps
- Standard pentesting, cloud, or DFIR tools
- Official vendor documentation
- General non-interactive technical references
Important Responsibility
You are responsible for your local operating system, hardware, internet connection, and home-network configuration during the exam window.
Review How to Prepare →Use resources—without outsourcing your judgment.
Allowed
- Your own notes, scripts, tools, and reference material
- Official vendor documentation and general technical articles
- Generic helper code that you understand and can explain
- Independent research on non-exam-specific techniques
- AI for generic helper code or non-exam-specific text clarification
Not Allowed
- Collaboration, live coaching, pair-hacking, or screen sharing
- Sharing exam hosts, IPs, screenshots, configurations, or solutions
- Sending exam-specific information to an AI service
- Using AI or another person to solve the environment or write substantial report content
- DoS/DDoS, intentional system damage, or activity outside authorized scope
Academic integrity protects the value of your credential.
You must understand and take responsibility for every command, script, conclusion, and report statement you submit. Integrity violations or deliberate attacks against grading, VPN, hypervisor, or out-of-scope infrastructure can result in immediate disqualification and loss of future exam eligibility.
Your report is part of the exam.
Submit one PDF using the official Encrypted Syntax report template before the seven-day window closes. Late reports are accepted only when an extension was granted in writing before the deadline.
A clear path forward after every result.
Your initial seven-day practical exam and report submission.
One free retake after an unsuccessful first attempt. It must begin immediately or within seven days of the result and uses the same exam version.
Additional attempts require a new voucher and may use the same or a different exam version at the Institute’s discretion.
Every result is manually reviewed.
The exam should feel demanding—not mysterious.
Review the preparation roadmap before activating your window, organize your evidence workflow, and reserve enough time to produce a professional report.
Open the Preparation Guide