Step 311. ★ The Second 24-Hour Mock Exam — Verification Day, Measuring Whether the Remediation Worked
Level 4 — OSCP Preparation & Sitting the Exam | Difficulty ★★★★★ | Estimated time: 3 days (half a day fixing the improvement list + 24-hour mock exam + 1 day of comparative analysis)
Prerequisites: the first mock exam from Step 309, and Step 310’s failure-pattern analysis and remediation (reproduction logs, checklist, revised rules) complete.
- What you need: a new machine set that doesn’t overlap the first exam, the improved when-stuck checklist, the revised time-allocation rules,
lap_timer.pyandcompare_exams.py, and the report template. Every machine-takedown and score scene in this chapter is a screen example. - ⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Machines must come only from platforms officially opened by their operators for attack practice, such as OffSec labs, Hack The Box, and Proving Grounds.
- This chapter is verification — confirming with a second 24 hours whether Step 310’s remediation was real, and whether reaching the passing range is skill rather than luck.
A single passing-range score can be luck. The machine set may have happened to match your strengths; the blocked spot may have happened to open. The only way to separate skill from luck is reproduction — a different set, a different day, the same rules.
At the same time, today is also experiment day. It is the last chance to deliberately vary what the first exam couldn’t settle — the machine order and time allocation that fit you. If you don’t want to shake your strategy on exam day, the shaking experiments must end today.
1. Learning Objectives
By the end of this chapter, you will be able to:
- Organize Step 310’s remedy deliverables into an "improvement list" and fix the items to apply on the second exam
- Perform a same-rules 24-hour mock exam on a new machine set, verifying the real-world application of the remedies
- Check in real time whether failure types recur, recording during the exam
- Judge improvement numerically by comparing the two exams’ scores, per-machine times, and failure-type distributions
- Turn the comparison result into a final fixed document of exam-day strategy (order, caps, sleep block)
2. Background Knowledge — Today’s Tools and Concepts
Today’s Tools at a Glance
| Category | Details |
|---|---|
| Language/environment | New mock exam machine set, Python 3 (lap_timer.py, compare_exams.py), the improved checklist |
| Today’s commands | python lap_timer.py start/lap/status/report, python compare_exams.py |
| Concepts needed | The improvement list, improvement verification metrics, type-recurrence checks, absolute score vs type distribution, strategy finalization |
| Today’s deliverable | Second exam log + exam 1/exam 2 comparative analysis + the exam-day strategy final document |
2-1. The Second Exam’s Purpose Is Not the Score
There are three questions the second mock exam must answer.
- Did the remediation work — did the type Step 310 set out to shrink actually shrink?
- Is the passing bar reproduced — do you clear 70 points (example basis) even with a different condition and set?
- Is the strategy fixed — is the order and allocation you’ll use on the day backed by two rounds of data?
What to watch is the interpretation of #2. The score may come out lower than the first exam — because machine-set difficulty varies. Look not at the absolute score but at whether the failure types shrank. If missed enumeration fell from 2 cases to 0 while the score dropped 5 points, that exam is a success.
2-2. The Improvement List — The Format That Loads Remedies onto the Exam
Step 310’s deliverables don’t operate by themselves in the exam room. Between "I remediated" and "I use it mid-exam," a bridge called the improvement list is needed.
Improvement list example (written the day before, stuck beside the monitor during the exam):
[1] (② countermeasure) 30 min stuck → force the checklist open
new items: backup extension scan / sudo -l·SUID·cron 3-minute check / MSSQL xp_cmdshell
[2] (③ countermeasure) cap as a clock time: set the end time on the physical timer when starting a machine
[3] (① countermeasure) AD set: include an AS-REP roasting attempt when credentials are obtained
[4] (⑤ countermeasure) "4 kinds of evidence confirmed" check on each machine's closing lap
[5] (④ countermeasure) sleep block at 14:00 elapsed — 2 alarms, sleep in the living room (not the desk)
Write each item not as "what" but as "when and how it triggers." An improvement without a trigger condition doesn’t reach the brain at hour 15 of the exam.
2-3. Recurrence Checks — Tracking Types During the Exam
The moment a first-exam type recurs can be caught not after the exam ends but during the exam. Add type tags to the lap log.
Lap record rule addition (from this exam on):
- When switching away blocked: lap "standalone-B" "switch" "switched after checking all 12 checklist items — enumeration complete"
- When the checklist broke through: lap "standalone-C" "breakthrough" "checklist item 7 (sudo -l) was the answer — ② countermeasure worked"
- When the cap was kept: lap "AD-set" "switch" "kept the 03:00 rule — ③ countermeasure worked"
Why: these tags are the raw material for the post-exam comparison. An exam with 3 "② countermeasure worked" laps is an exam where the remediation operated, regardless of score. Conversely, if there’s not a single tag — it’s the same as not having brought the checklist to the exam room.
2-4. Reading the Comparison — What the Numbers Say and Don’t Say
There are four things to read in comparing the two exams.
| Metric | Direction to read as improvement | Caution |
|---|---|---|
| Score | Rising is nice but not the #1 | Set difficulty variance contaminates the score |
| Failure-type distribution | A drop in the remediated type is the core | A new type appearing is a new remediation task |
| Machines over the cap | Fewer = ③ improved | If an overrun still converted to points, review the rule |
| Sleep time | Plan kept = ④ improved | If you raised the score by cutting sleep, that’s a foul — a strategy impossible on the day |
The verdict at the end of the comparison is binary — "finalize exam-day strategy" or "third mock exam." If both exams are at the passing bar and the most frequent type shrank, it’s finalize. If either falls short, remediate the lacking side again through Step 310’s procedure and verify once more. Setting the exam date after that is not too late.
3. Follow Along
3-1. Set Composition and Fixing the Improvement List
Same conditions (composition, rules) as the first exam, but all-new machines. A machine you re-attacked cannot be a subject of this experiment.
Pre-start checks:
[ ] New set: 1 AD set + 3–4 standalones, zero overlap with the first exam
[ ] Improvement list (2-2) written — stuck beside the monitor
[ ] Improved checklist file open from the start
[ ] Machine caps, sleep, mid-exam reviews reserved on a physical timer (phone alarms, etc.)
[ ] One line recording the difference between exam 1's strategy and this one — e.g., "exam 1 AD-first → exam 2 parallel recon"
The last item is exam 2’s experimental design. Varying the strategy is allowed, but only one thing at a time — change order and caps simultaneously and you can’t compare which one had the effect.
3-2. Running the Exam — Same Body as Exam 1, Different Procedure
The exam run itself is identical to Step 309. What differs is only that type tags (2-3) attach to the laps, and that you observe whether the improvement list fires on its trigger conditions.
Screen example (exam 2’s lap log):
[+00:30] full-recon — done — all machines scanned, starting with the easy standalones (exam 2 strategy)
[+02:40] standalone-E — done — 20 pts, 4 kinds of evidence confirmed [⑤ countermeasure worked]
[+03:00] AD-set — started — physical timer set for 06:00 [③ countermeasure worked]
[+05:10] AD-set — breakthrough — AS-REP roasting success (exam 1's ① remedial study was the answer)
[+08:20] AD-set — finished — 40 pts to DA
[+14:00] sleep — start — 4h 40m [④ countermeasure worked]
[+19:30] standalone-F — breakthrough — checklist item 7 was the answer [② countermeasure worked]
[+22:00] closing block — partial points organized + report first draft
How to read it: the bracketed tags are this log’s core — the remedies are recorded not as "documents" but as "mid-exam events." Counting these tags after the end alone tallies how many times the remediation operated.
3-3. Post-Exam Comparison — Verdict with compare_exams.py
Build summaries of the two exams as JSON and compare. First, learn the output with the built-in example — this is the measured result.
python compare_exams.py
=== Exam 1 vs Exam 2 mock exam comparison ===
Score : 50 pts → 80 pts (+30)
Machines finished : 1 ['standalone-A'] → 3 ['AD-set', 'standalone-E', 'standalone-F']
Sleep : 3h 20m → 4h 40m
[Failure-type distribution change] — this table, more than the absolute score, is remediation's report card
Type 1st 2nd verdict
1 missing technique 1 0 ✅ improved
2 missed enumeration 2 1 ✅ improved
3 time management 1 0 ✅ improved
4 stamina collapse 0 0 ➖ same
5 insufficient report 1 0 ✅ improved
Machines over the cap (3h): 1 → 1 ['AD-set']
Verdict basis: even if the score fell, if missed enumeration (type 2) and cap overruns shrank,
remediation succeeded. Machine-set difficulty varies,
so don't cut your confidence by the absolute score alone.
How to read it: this example’s verdict is a clear "strategy finalize" — score +30, every remediated type reduced, sleep plan kept. The remaining task is "1 machine over the cap (the AD set)" — the AD set is chained, so a 3-hour cap can be tight; this data becomes the grounds for the exam-day rule revision "adjust the AD set cap to 3.5–4 hours." Compare your own data with python compare_exams.py exam1.json exam2.json — the JSON format is in the comment at the top of the tool.
3-4. The Exam-Day Strategy Final Document
Once the comparison verdict is in, fix the strategy the two exams’ data supports into a one-page document.
Exam-day strategy (example — fill with your own data):
- Order: parallel recon 30 min → 1 easy standalone → AD set → remaining standalones
- Caps: standalone 3h / AD set 4h (grounds: exam 2 data) — at cap, defer the slot (not give up)
- Checklist: forced open every 30 min stuck (15 items total)
- Sleep: 4.5 hours at 14h elapsed — 2 alarms, living room, not the desk
- Meals: 09:00 / 18:00, including a 20-minute walk
- Evidence: the 4 kinds immediately on shell — celebration comes after
- Closing: from 2h before the end, partial points + report
- When panic: "Both exams 1 and 2 had scoreless opening stretches. Trust the timetable."
Why the last line exists: exam-day panic is calmed by memory, not technique. With the sentence "it was like this in practice too, and following the timetable, it solved" written in advance, panic becomes not an incident but a scheduled stretch.
4. Missions & Exercises
Mission — The Second Mock Exam and Strategy Finalization
- Compose a new set with zero overlap with the first exam, and write and post the improvement list (with trigger conditions).
- Finish 24 hours under the same rules — record type tags (countermeasure worked / recurred) in the laps.
- Experiment by changing one thing only of strategy from the first exam, and record what you changed.
- After the end, build summary JSON of both exams, compare with
compare_exams.py, and issue the verdict (finalize / retest). - Complete the report within 24 hours too, rehearsing the whole submission process.
- Write the exam-day strategy final document (one page) — including the panic sentence.
Exercises
Exercise 1. When varying strategy on the second exam, why must you change "one thing at a time"?
Exercise 2. Exam 2’s score came out lower than exam 1’s, but the remediated type (missed enumeration) shrank from 2 cases to 0. How should this result be interpreted, and what is the verdict?
Exercise 3. Why record type tags ("② countermeasure worked," etc.) during the exam? Explain together with why organizing them from memory after the end won’t do.
Exercise 4. Why is an exam 2 that raised its score by cutting sleep a "foul"? Explain from the perspective of verification.
5. Model Answers & Completion Criteria
Mission Model Answer
Verify against these criteria.
- Set independence: zero machines overlapping exam 1 — a re-attacked machine mixed in contaminates the remediation verification.
- Improvement list trigger conditions: is each item written as "when, how" — "use the checklist well" is not a list.
- Single-variable experiment: was only one strategy changed, and is it recorded?
- Type tags exist: are "countermeasure worked / recurred" tags actually captured in the lap log — no tags means the improvement list was decoration.
- Comparison verdict grounds: is the finalize/retest verdict grounded in the type-distribution change — a verdict that looked only at the score should re-read the table in 2-4.
- Final document completeness: are order / caps / sleep / meals / evidence / closing / panic sentence all on one page?
Exercise Answers
Answer 1. Because of comparability. Change order and caps simultaneously and you can’t tell which side to attribute the result’s difference to — with two variables, cause attribution is impossible. Change one at a time and you can read "the exam 1–exam 2 difference is that one’s effect." Two exams are not statistics but two samples, so the simpler the experimental design, the more honest the interpretation.
Answer 2. It should be interpreted as remediation success. The score is a metric contaminated by set difficulty variance; the type distribution is a metric made by your procedure. Remediation’s goal is "not collapsing for the same reason on the next exam," so if the remediated type is at 0 cases, Step 310’s work succeeded. The verdict is — provided the other conditions (sleep kept, finished) are met — finalize exam-day strategy. But if the score is below the passing bar, beyond the type analysis, record in one line "the structural reason the score fell short" (e.g., AD unfinished) and reflect it in the exam-day strategy’s priorities.
Answer 3. Because an event from during the exam must be recorded during the exam to be data. Organized from memory after the end, the brain that crossed 24 hours of fatigue reconstructs "mostly the good parts" — stretches where countermeasures didn’t operate easily drop out of memory, and then recurrences don’t appear in the data. Also, the act of tagging itself forces the improvement list to fire — to write "② countermeasure worked," you must actually have opened the checklist, so the record plays the role of the procedure’s supervisor.
Answer 4. Because verification’s purpose is confirming "a pass reproducible on the day." A strategy that cuts sleep is one you can’t use on the day, or if you do, one that rather cuts points through the judgment collapse of the exam’s latter half — even if it happened to hold up in the mock exam, it has no reproducibility. A verification experiment’s conditions must equal the real conditions, so a score obtained under conditions impossible on the real exam (no sleep) is not evidence but a mirage. This is why sleep compliance is included among the comparison metrics.
Completion Criteria Checklist
- [ ] I finished the second 24 hours on a new set with zero overlap with exam 1
- [ ] I wrote and posted the improvement list with trigger conditions
- [ ] I recorded type tags (countermeasure worked / recurred) in the lap log
- [ ] Only one strategy was changed, and it’s recorded
- [ ] I completed the two-exam comparison (score / type distribution / cap overruns / sleep)
- [ ] I issued a verdict (finalize / retest) grounded in the type-distribution change
- [ ] I completed the report within 24 hours, rehearsing the submission process
- [ ] I completed the one-page exam-day strategy final document (including the panic sentence)
6. Common Pitfalls & Fixes
Wall 1. Exam 2’s score is lower than exam 1’s and my confidence collapses
Symptom: "I remediated, so why did I do worse" — you want to restart everything.
Cause: you’re misreading the absolute score as remediation’s report card. Different sets mean different difficulty, and different difficulty means scores can’t be compared.
Fix: look not at the score but at the failure-type distribution. If missed enumeration shrank, the remediation succeeded, and that was this exam’s purpose. If the score drop has a structural cause like an unfinished AD set, that’s grounds for revising the exam-day strategy (priorities), not an evaluation of your skill.
Wall 2. I fed JSON to compare_exams.py and got an error
Symptom:
json.decoder.JSONDecodeError: Expecting property name enclosed in double quotes: line 2 column 3
Cause: JSON requires keys wrapped in double quotes — single quotes like a Python dictionary produce this error.
Fix: copy the format example from the comment at the top of the tool and change only the values. If writing by hand is hard, make it with Python — paste the string produced by python -c "import json; print(json.dumps({'score': 50, ...}))" into the file and there’ll be no format errors.
Wall 3. I posted the improvement list and never looked at it once during the exam
Symptom: after the end, you realized you’d forgotten the list existed.
Cause: while absorbed, peripheral vision disappears — posting is a necessary condition, not a sufficient one.
Fix: change the trigger to clock-based alarms — "open when stuck" requires noticing you’re stuck to fire, but a "look at the list for 10 seconds on the hour" alarm fires without awareness. Same structure as exam 1’s lesson (③ countermeasure) — replacing memory and awareness with devices. Add "hourly list check" to the next exam’s laps.
Wall 4. Different types appear in exams 1 and 2 — the remediation seems endless
Symptom: you remediated missed enumeration, and this time you got stuck on a new technique (①).
Cause: normal, and actually a good signal — with the operational problems (②③④⑤) cleared, the real technique map has been revealed. Until now, technique holes were hidden behind operational failures.
Fix: run the new type through Step 310’s procedure once more, as-is — re-attack that machine and study the topic with reproduction. The remediation isn’t "growing"; it’s "descending from shallow layers to deeper ones." Set the exam date after every layer is cleared — hurrying is the most expensive strategy.
Wall 5. Both exams are in the passing range, yet the anxiety remains that "the real thing will be different"
Symptom: the data is sufficient but conviction won’t come.
Cause: rational anxiety — the mock exam and the real thing differ in proctoring, VPN, and pressure. Still, this anxiety is not to be eliminated but managed.
Fix: convert the anxiety into a document — write the list of "things different in the real exam" (proctoring, ID verification, unfamiliar machines) and attach a response procedure to each item. An anxiety with a response procedure attached becomes a checklist, and an anxiety turned checklist becomes, on the day, not anxiety but a task. Attach this list to the back of the strategy final document and make it part of your exam kit.
7. Summary
Today’s Concepts
| Concept | One-line explanation |
|---|---|
| Verification by reproduction | One passing-range result may be luck — clear it again on a different set for skill |
| Improvement list | The bridge that loads remedies onto the exam — trigger conditions (when, how) mandatory |
| Type tags | Mid-exam marks of remedy operation — countermeasure worked / recurred |
| Type distribution first | Absolute score is contaminated by difficulty variance — the distribution change is remediation’s report card |
| Single-variable experiment | Strategy changes one at a time — two variables make cause attribution impossible |
| Strategy final document | Exam-day operations supported by two exams’ data — panic sentence included |
Today’s Commands
| Command | What it does |
|---|---|
python lap_timer.py start/lap/status/report |
Exam 2’s timer & log (same as exam 1) |
python compare_exams.py |
Practice reading the exam 1/exam 2 comparison with the built-in example |
python compare_exams.py exam1.json exam2.json |
Compare and judge the real two exams |
python fail_analyzer.py analyze fails2.csv |
Aggregate exam 2’s failure types |
The Core Instinct
When the second exam ends, you have what most candidates don’t — a strategy grounded in your own data. Not "do AD first" read from someone else’s write-up, but "this is how I have to do it to pass," proven by two rounds of 24 hours. Exam-day calm doesn’t come from confidence — it comes from the record saying "this timetable has been verified twice."
Once every box is checked, Step 311 is complete.