Certified Active Directory Pentesting Expert v2 (C-ADPenXv2) - Review 🚀

Hey again everyone! This is Foued SAIDI: Senior Penetration Tester at Cyber-SSI , holder of C-ADPenXv2, CRTE, CRTP and CARTP professional certifications, currently an Elite Hacker ranking within the top 100 WorldWide on Hack The Box platform.

I have recently passed my Certified Active Directory Pentesting Expert v2 (C-ADPenXv2) certification from The Secops Group and I would like to share my feedback regarding it along with a few tips for anyone planning on passing it.

C-ADPenXv2 Overview

First of all, C-ADPenXv2 is a 7h certification where the holder has the expertise to assess the security posture of a fully-patched Windows Infrastructure having multiple Domains by purely abusing functionalities and trusts.

Something I really like to see, which I found in The Secops Group’s work, is that their professional certifications only rely on misconfigurations and logic abuses, not some CTFy unrealistic stuff.

I consider achieving this certification a really worthwhile investment as it is priced at 400 euro but they are currently providing a 90% discount code on it (CADPenX-v2-90), which drops it to 40 euro. And let me tell you something, it is REALLY worth it, even to pay for 400 euro voucher (comparing it to oher vendors). This voucher includes two exam attempts (or that’s what I got at least). In case of failure, you can even try to reach out to their support team and they might be so kind to give you a new free attempt (and yes, they are really kind!).

Course Content

Unfortunately, the Secops Group do not provide learning material alongside the voucher. They entirely provide only exam vouchers. But that’s not a bad thing after all, that way you don’t just only rely on course material offered by the developers of the course, this way you don’t know what’s coming at you and have to study from every material you stumble upon.

C-ADPenXv2 mock exam

The Secops Group usually provide mock exams to go with their pentesting certifications. However, at the time of this article’s writing, there isn’t still a mock exam for the C-ADPenXv2 exam, but there will be in the near future.

Exam Environment

The exam is a 7h completely hands-on experience. Once started, the exam lab runs for 7h30. You get an additional 30 minutes to compensate for the lab setup time of 5-10 minutes (a huge + Secops Group).

The exam consists of 14 questions that must be answered to pass the certification:

Candidates scoring over 60% marks will be deemed to have successfully passed the exam.
Candidates scoring over 75% marks will be deemed to have passed with merit.
Anything below 60% is a fail.

I cannot be disclosing any information regarding the infrastrcture of the exam, but what I can say is that it’s a multi-domain infra simulating that which you can find in real life engagements and you’d basically have to own the full infra.

During the exam, the candidate cannot restart the lab instance, neither single instances nor the whole infrastructure. If you break it, you deal with it (as in real life engagements). The support team cannot help during this time too if you break a machine and you’d have to take a new attempt.

As for automations, there are a few automations during the launching of the instance and a few during the exam itself, but not all features are automated and can be re-attempted after you restart a machine for example.

As for me personally, I have passed the exam with merit (score of 89%) from my second attempt after failing my first. I will be talking about why I failed in a later section of this article. So do not be discouraged if you failed your first attempt.
I also only got 89% because I couldn’t finish the final question, when I had already executed the exploit for it (which is a 3-step exploit), I only had 3 minutes remaining to finish it so I didn’t.

I really like this results page btw!

While doing the exam, please make sure you are taking well-structured notes at the same time as this will be crucial for you to stay as organized as possible and not miss any info/credential/access during the process. I you don’t take notes, you’ll just be losing all the access you already got.

(I use notion as it is really easy to use and has really amazing integrations for code snippets and screenshots pasting, although I feel it’s really laggy sometimes).

Reason why I failed my 1st attempt

This is actually a really straight reason for why I failed my first exam attempt: I was being a bit cocky. I entered the exam thinking that this would just be another casual pentesting certification that I’d be able to finish in a couple of hours and call it a day. I skipped a lot of initial crucial enumeration thinking that some stuff wouldn’t occur and I simply was not being as focused as I should have been. So do not do what I did, focus and give this exam your full focus as it is no joke!

Time Management

One thing that those who think of passing the C-ADPenXv2 exam should give a really good thought to, is time management. Since you have 7h30, which is not a lot of time (but jusy enough to pass the exam), you’ve got to really stay organized and not waste any time.

One thing I could advise you to do, is to try and avoid rabbit holes (there isn’t any but still) and don’t get too stuck on a single endpoint or vulnerability (or something you might think is vulnerable).

C-ADPenXv2 exam pros and cons

Pros:

What I really liked about C-ADPenXv2:

Everyone candidate gets a personal instance just for them. Even we re-attempting a second attempt at the exam, you get a new fresh instance just for you.
The really stable lab and exam environments.
The responsive support. In my first attempt they even launched a google meet call with me to try and resolve an issue I had. However, they do not respond outside of work hours. So if you’re planning on passing the exam, do it during their work hours.
The realistic side about the exploits and vulnerabilities treated in the exam.
The really nice pricing on the certificate and the coupons they offer regularly.
That the exam actually touches almost every aspect of AD exploitation: local and domain privilege escalation, lateral movements, hybrid environments, trust abuses…

Cons:

The questions being asked during the exam can be a bit misleading. Like you’d get asked about something and you’d logically think it’s directly related to the previous question, but it takes a few more extra steps to get there. So the questions can use a little remake. So my advice to you during answering the questions is to just directly try to own all of the domains, later you’ll be able to answer the questions smoothly.
During the exam, there were a couple of things who should’ve been working in a specific way but their behavior was a bit changed, which wouldn’t happen (at least in that context) in real life infrastructures. So the exam infra and path still need a bit of testing.

Things I’d like to see in the future

The only missing part in my opinion in this course was to try and tackle another well-utilized EDR/XDR/Security Solution like SentinelOne, CrowdStrike, etc. So seeing a partnership between these entites and the Secops Group in the future would really step up the game.

Practical Tips

Some tips that will help you alond the way:

Enumeration is really key, do not neglate that.
Take notes, they will REALLY help you while studying and you can get back to them anytime.
Remember to do at lest a 10mn walk if you feel stuck, it can really refresh your mind as it helped me.
Review your learning notes before passing the exam, also keep them open on the side for easy access.
Always try to think out of the box and as a creator of the exam, it’ll give you new insights
Stay hydrated :=) (seriously haha)

Personal Opinion

I really loved the C-ADPenXv2 exam. Great Active Directory chain, responsive lab support team, stable infrastructure. It is a great Certification for anyone looking to get into Active Directory security.
One last thing, comparing the C-ADPenXv2 to other pentesting exams I have passed, I’d say it’s probably the hardest so far (compared to CRTE and CRTP). Especially since it is not an assumed-breach approach and you’d have to fully own the infra from the outside.
Comparing to a Hack The Box machine, I’d say it easily ranks somewhere between a hard and an insane rated machine. Closer to hard tho.
I will hopefully be getting back for more certifications from the Secops Group as they have really surprised me with this offering and will be expecting the same high-level of pentesting exams for the rest of the offerings.
Stay tuned ! Hope you enjoyed this blog post, and see you soon!

Foued SAIDI (A.K.A. 0xkujen)