The CPTS prep market has a credibility problem, and it is not subtle. Sellers repackage generic penetration testing notes, rename the file, and advertise it as exam material. Candidates pay, discover the content has nothing to do with the exam’s Active Directory network or its report requirement, and conclude that all prep material is the same.
It is not. The difference is verifiable, and you can check it before paying. This is the checklist I would use on any provider, including this one.
First, know what the exam actually is
You cannot evaluate material without a reference point. The CPTS exam:
- Requires the Penetration Tester job-role path completed 100% — 28 modules, each with a skills assessment.
- Runs for ten days on a dedicated lab instance, with a letter of engagement defining scope.
- Requires flags submitted on the exam page and a commercial-grade report uploaded within the same ten days.
- Provides a report template, so structure is not the differentiator — quality is.
- Allows two attempts, with the retake starting within fourteen days of feedback.
- Does not expire.
Any material that claims to prepare you for CPTS without addressing the AD network, the engagement letter, or the report is not CPTS material. It is general pentest content with a new title.
Seven checks that separate real material from repackaged notes
1. Specificity of scope
Ask what the material covers, exactly. A real provider can name the phases: external enumeration, web footholds, internal pivoting, AD attack paths, privilege escalation, reporting. A repackager names certifications, not content.
2. Structure that matches the exam flow
CPTS is a network engagement, not a set of isolated boxes. Material should be organised as a path: foothold → credential access → lateral movement → domain compromise. If the table of contents reads like a list of unrelated techniques, it will not help you under the exam’s structure.
3. Evidence standards
Walkthroughs should show command output, not just commands. Screenshots should show host context. If the material does not demonstrate evidence standards, it cannot teach you what the report requires.
4. Report coverage
This is where most products fail. The CPTS report is graded by a human against commercial expectations. A template is provided by HTB, so a provider that only supplies “a template” has added nothing. Real value looks like worked examples: how to write the executive summary, how to narrate an attack chain, how to phrase remediation.
5. Update policy, stated plainly
HTB updates the path and the exam scenarios. Ask how updates are handled: are they included, how are they delivered, is there a version history? A provider who cannot answer has not thought about it.
6. Claims that can be checked
“Passed first attempt” is marketing. Verification looks like a named product page, a delivery process, and terms you can read before purchase. If the only proof is a screenshot with no context, treat it as decoration.
7. Refund terms in writing
Digital products are difficult to refund, which is exactly why the terms matter. Read the refund policy before paying, from any provider. A 14-day window with stated conditions is a real policy; “contact us if there is a problem” is not.
Red flags worth walking away from
- Guaranteed pass language. No legitimate provider controls the exam result.
- “Exact exam questions”. The exam uses a dedicated instance with per-candidate flags. Exact questions cannot exist.
- One file for every certification. The same PDF with different covers is the most common scam pattern.
- Payment only through informal channels. Personal transfers with no receipt remove your ability to dispute.
- No product page, only a DM. You cannot evaluate what you cannot read.
What good preparation actually does
Assuming the material is legitimate, its job is narrow and useful: compress the search for what to study, show how intended paths are structured, and demonstrate the documentation standard. It does not replace the path modules or lab time, and any provider claiming otherwise is selling confidence rather than preparation.
A realistic split for the final month:
| Activity | Share | Why |
|---|---|---|
| Lab practice and path assessments | 50% | The exam tests execution |
| Report writing practice | 20% | Half the certification is the deliverable |
| Structured review of attack chains | 20% | Pattern recognition under time pressure |
| Material review and note consolidation | 10% | Keeps decisions consistent |
If a provider’s material pushes that ratio toward passive reading, it is optimised for sales rather than results.
Questions to ask before you buy anything
- Does this cover the AD network and the report, or only standalone techniques?
- Can I see a sample page with real command output?
- How are updates delivered after an exam revision?
- What exactly does the refund policy cover?
- Is there a product page with delivery terms I can read before paying?
Five questions, five minutes. Any provider that dodges two of them is telling you something.
Where to go next
For the certification overview, pricing, and our own CPTS material, see the CPTS certification hub. For execution rather than evaluation, the ten-day CPTS plan maps the exam window day by day, and the AD enumeration workflow covers the phase that decides most attempts.
Certification names belong to Hack The Box. This is independent study material, not official course content.
Web application security specialist and bug bounty hunter. OSWA and OSWE certified, focused on web exploitation, API security and source-code review. Writes our web exploitation walkthroughs and reviews report structure for web-focused certifications.