Scope: what the exam tests

The fastest way to waste prep time is studying things that never come up. Here’s how to know what’s actually in scope, from someone who went in and checked rather than guessing.

The reliable signal

The exam only draws from the vulnerability topics that meet two conditions:

1. They have Practitioner-level labs in the Web Security Academy (the ones marked as PRACTITIONER), and
2. They show up as selectable categories inside the mystery labs.

That mystery lab category list is effectively your syllabus. If a topic isn’t selectable there, you almost certainly won’t meet it on the exam. Use that as your filter before you grind a single extra lab.

Commonly assumed, but out

A few topics people expect to study and then burn time on for nothing:

• Prototype pollution. I assumed this was fair game. It isn’t a selectable mystery category, so I ruled it straight out, and that was the right call.
• GraphQL and WebSockets. Same story. Not selectable, widely treated as out of scope.

If you’ve seen these on someone’s “study everything” list, that’s the list costing you hours.

The grey area

• Race conditions and other exotic categories. I’ve come across the occasional unverified claim of these turning up. I can’t vouch for any of it, and I wouldn’t build a study plan around rumours. Cover the confirmed scope thoroughly first. If you still have spare time, a light pass over the edge cases won’t hurt, but don’t let them eat into the core.

Takeaway

Before anything else, open the mystery lab category list and the Practitioner topic list side by side. That is your map. Study to it, not to everything PortSwigger has ever published.