The HTB Certified Active Directory Pentesting Expert, or HTB CAPE, is not a theory exam. It tests whether you can work through a realistic Active Directory attack path, think clearly under pressure, and document what you find. That changes how you should study. Reading notes is not enough. You need a plan that builds technical depth, then turns that knowledge into repeatable actions. This guide is for candidates who already have some exposure to HTB Academy, lab work, or AD pentesting and want a practical 30-day roadmap. It also works as a skills checklist you can reuse with a study group or mentor.
Who should use this guide
This guide is best for people in one of these groups:
- HTB Academy learners who have completed or nearly completed Active Directory-related modules but do not yet feel exam-ready.
- Hands-on certification candidates who learn best by doing labs, rebuilding attacks, and reviewing mistakes.
- Junior pentesters or security engineers who know the basics of Windows and networking but need a focused AD exploitation plan.
- Self-study candidates who need structure more than more content.
If you are completely new to Windows internals, Kerberos, LDAP, PowerShell, and basic privilege escalation, pause and build those first. The CAPE is much easier when core AD concepts feel familiar instead of new.
What the exam is really testing
The goal is not just to “get root” on a machine. In an Active Directory exam, you are usually proving that you can move through a domain in a logical way. That means you must be able to:
- Enumerate properly so you do not miss users, groups, shares, ACL issues, or trust relationships.
- Recognize attack paths such as weak permissions, kerberoastable accounts, delegation issues, password reuse, or misconfigured group membership.
- Chain findings together because one small credential or permission often matters only when combined with a second weakness.
- Operate cleanly by keeping notes, saving commands, and tracking what each credential can access.
- Write clearly so your report explains what happened, why it worked, and what evidence supports it.
That last point matters more than many candidates expect. If you cannot explain your path, you do not yet fully understand it.
Prerequisite knowledge and tools
Before starting the 30-day plan, make sure you are comfortable with the following areas. These are not optional. They are the floor, not the ceiling.
Core knowledge
- AD structure: domains, forests, OUs, users, groups, computers, GPOs
- Authentication basics: Kerberos, NTLM, tickets, hashes, SPNs
- Windows privilege concepts: local admin, service accounts, token use, ACLs
- Common attack paths: kerberoasting, AS-REP roasting, password spraying, ACL abuse, lateral movement, delegation abuse
- Basic Linux and Windows command-line use
- Report writing and note-taking discipline
Tool familiarity
- BloodHound for graph-based path analysis
- SharpHound or equivalent data collection methods
- Impacket tools for remote execution, authentication, and ticket abuse workflows
- CrackMapExec or NetExec-style tooling for broad validation and auth testing
- PowerShell and native Windows commands for local and domain enumeration
- RDP, WinRM, SMB, and common remote admin workflows
- Hash cracking workflow with realistic wordlists and rule use
If any tool in that list still feels “button-click only,” spend time learning what it actually does. For example, BloodHound is useful only if you understand why an edge exists and how to abuse it safely.
30-day HTB CAPE preparation plan
This plan assumes you can study about two to three focused hours on weekdays and more on weekends. If you have less time, keep the sequence and stretch the calendar. Do not compress the hands-on work. Practical recall matters more than speed at this stage.
Days 1–6: Build your foundation
- Day 1: Define your exam environment. Set up note templates, command logs, screenshot folders, and a credentials tracker. This saves time later and reduces mistakes.
- Day 2: Review AD structure and object relationships. Focus on how users, groups, computers, OUs, and GPOs interact. If you cannot explain these simply, revisit them.
- Day 3: Review Kerberos and NTLM. Learn what TGTs, TGS tickets, SPNs, and pre-authentication actually mean in attack terms.
- Day 4: Practice basic domain enumeration from both Linux and Windows. Enumerate users, groups, shares, sessions, and policies.
- Day 5: Study credential attacks. Practice password spraying logic, kerberoasting, and AS-REP roasting in a lab. Record what successful output looks like.
- Day 6: Review Windows privilege and ACL basics. Focus on why permissions create escalation opportunities.
The goal in this phase is not mastery. It is to remove confusion. You want each major concept to feel recognizable before you start chaining attacks.
Days 7–14: Domain attack path review
- Day 7: BloodHound day. Collect data, import it, and practice reading shortest paths to high-value targets. Pick three paths and explain them in writing.
- Day 8: Group membership and nested privilege review. Practice tracing how one low-privilege account can inherit useful access.
- Day 9: ACL abuse review. Focus on GenericAll, GenericWrite, WriteDACL, AddMember, ForceChangePassword, and similar permissions. Understand the abuse method for each.
- Day 10: Lateral movement day. Practice SMB, WinRM, scheduled tasks, remote service execution, or whichever methods your lab supports.
- Day 11: Delegation concepts. Review constrained delegation, unconstrained delegation, and resource-based constrained delegation at a practical level.
- Day 12: GPO and login script review. Look at how policy or script misconfigurations can expose credentials or code execution paths.
- Day 13: Service accounts and SPN abuse. Combine enumeration, ticket requests, cracking, and account validation.
- Day 14: Mini simulation. Start with one foothold and build a full attack chain with notes and evidence.
This week matters because the exam is rarely about one trick. It is about seeing how separate clues fit together. If your notes are messy by Day 14, fix that now.
Days 15–20: Practice questions and applied scenarios
- Day 15: Do a timed set of practical review questions or scenario prompts on enumeration and initial access.
- Day 16: Do a timed set on credentials, tickets, and authentication abuse.
- Day 17: Do a timed set on ACL abuse, group abuse, and privilege escalation logic.
- Day 18: Do a timed set on lateral movement and post-compromise decision making.
- Day 19: Review every wrong answer or failed scenario. Write down not just the answer, but the reason you missed it. Was it a concept gap, a tooling issue, or a rushed assumption?
- Day 20: Rebuild two full attack chains from scratch without looking at notes.
The point of practice questions is not memorization. It is pattern recognition. If a prompt mentions SPNs, weak service account hygiene, and crackable tickets, your brain should immediately connect the path and the conditions that make it valid.
Practice with the relevant page only: Hack The Box HTB Certified Active Directory Pentesting Expert (HTB CAPE) Practice Test
Days 21–25: Weak-area repair
- Day 21: Identify your bottom three topics. Be honest. Common weak areas are ACL abuse, delegation, and reporting.
- Day 22: Re-study weak area one with hands-on proof. Do not just reread notes. Execute the workflow.
- Day 23: Re-study weak area two the same way.
- Day 24: Re-study weak area three the same way.
- Day 25: Mixed drill day. Combine all three weak areas into short decision-based exercises.
This is where many candidates improve the most. General study feels productive, but targeted repair changes exam outcomes. A weak area usually causes repeated delays, missed pivots, and wasted time.
Days 26–30: Final revision and exam conditioning
- Day 26: Run one full mock workflow from enumeration to privilege escalation to reporting notes.
- Day 27: Create a one-page quick reference. Include your common commands, ticket workflow reminders, credential logging format, and escalation checklist.
- Day 28: Practice reporting. Write short findings with title, impact, evidence, steps, and remediation. Clear writing forces clear thinking.
- Day 29: Light review only. Validate your tools, VPN setup, note templates, time plan, and system stability.
- Day 30: Rest, skim your quick reference, and avoid panic-studying.
By the final days, your goal is not to learn new material. It is to become consistent. Consistency wins practical exams because it lowers the chance of overlooking a simple path.
How to review explanations without memorizing answers
This is one of the most important parts of exam prep. Many candidates do enough practice, but they review it the wrong way. They read the solution, feel familiar with it, and mistake that familiarity for skill.
Use this review method instead:
- First, restate the problem in your own words. Example: “I had a low-privilege user with share access and missed the credential file.” This helps you see what the task was really asking.
- Second, identify the clue you missed. Was it an SPN? A dangerous ACL edge? A writable path? Most failures start with one ignored clue.
- Third, rebuild the attack path from memory. Do not look at the answer yet. Try to explain the sequence yourself.
- Fourth, compare your reasoning to the explanation. Focus on why the action works, not just which command was used.
- Fifth, repeat the same pattern in a fresh lab or variation. If you can repeat the logic in a slightly different context, you learned it. If not, you memorized it.
A good test is this: can you explain the attack to someone else without reading your notes? If yes, your understanding is probably solid.
HTB-style skills checklist
Use this checklist in the last two weeks. If you cannot do an item confidently, it belongs in your weak-area repair plan.
- Enumerate domain users, groups, computers, shares, and policies from both Linux and Windows perspectives
- Collect and analyze BloodHound data without guessing what graph edges mean
- Identify kerberoastable and AS-REP roastable accounts and explain when each attack applies
- Track credentials, hashes, tickets, and account context carefully during a multi-step attack
- Validate account access through SMB, WinRM, RDP, or other remote management paths
- Recognize dangerous ACLs and map them to a practical abuse action
- Understand group nesting and inherited privilege well enough to find non-obvious paths
- Perform lateral movement cleanly and verify what changed after each step
- Recognize common service account weaknesses and test them methodically
- Explain delegation abuse concepts in plain language, even if the lab path does not require them
- Write concise findings with enough evidence that another tester could reproduce them
- Recover from dead ends without losing track of tested credentials, hosts, and paths
This list is useful because it focuses on abilities, not just topics. Exams reward execution.
Final-week readiness routine
In the last week, simplify everything. Complexity causes stress. You want a routine that protects focus.
- Start each session with 10 minutes of recap. Review your quick reference, note structure, and common mistakes.
- Run one short enumeration drill daily. This keeps your opening workflow automatic.
- Do one reporting drill every other day. Practice turning raw notes into a clean finding.
- Limit tool switching. Use the tools you know best. The exam is not the time to test a new workflow.
- Review evidence discipline. Save outputs, screenshots, and timestamps in an organized way.
- Sleep properly. Active Directory exams punish mental fatigue because small clues matter.
Your readiness is not just technical. It is operational. Good note hygiene, calm pacing, and a stable environment directly improve technical performance.
FAQ
How many hours should I study each day for 30 days?
For most candidates, two to three focused hours on weekdays and a longer weekend block is enough if the work is hands-on. Six passive hours of videos usually help less than two hours of active lab practice.
What if I finish the plan and still feel weak?
Do not force the exam date. Repeat the weak-area repair section and add more mini simulations. Feeling unsure about one advanced topic is normal. Feeling unable to build an attack chain is a warning sign.
Should I memorize commands?
Memorize patterns, not giant command lists. You need to know what you are trying to prove, what data you need, and which tool can get it. A short personal cheat sheet is fine. Blind command memorization breaks when the environment changes.
How should I handle retakes if I fail?
Treat a failed attempt like a technical debrief, not a personal failure. List where time was lost, which concepts broke down, and whether note-taking or reporting hurt you. Then build a 10- to 14-day repair cycle around those exact issues.
Are practice questions enough for CAPE prep?
No. They help with recall and decision making, but the exam is practical. Practice questions are best used to reveal weak concepts and improve pattern recognition. The real preparation happens when you reproduce the attack in a lab.
What is the best practice strategy in the final week?
Short, focused repetition. Daily enumeration. One or two full path reviews. Light reporting practice. No cramming. Your aim is confidence and consistency, not volume.
Final thought
The best CAPE study plan is not the one with the most resources. It is the one that makes you better at noticing attack paths, validating them carefully, and documenting them clearly. If you follow a 30-day schedule with real hands-on repetition, honest weak-area repair, and disciplined review, you will walk into the exam with something much better than memorized answers. You will have a process. That is what practical Active Directory exams are really measuring.
