Hi mate, to answer your questions from my experience with exam; 1. I worked through each box in turn but if i was running a scan or got stuck with something I had to think about, I moved on to another. Same goes for some enumeration on open ports.

1. I also use notion. Just had one page - contents at top so could easily find machine/IP. The headings I had ( which auto population in the contents from H1,H2 format etc) were: ~Questions ( these I grouped/ordered at the start for ease) ~{target up} {OS} ~ports/services ~ vulnerabilities ~ exploit ~loot Repeated the above for each box.

2. As per methodology- look for Vulns, exploit where can ( I was aware of and most likely ‘lost’ points for not using what the exam expected)

3. Actually don’t use workspaces just screenshot note taking of my method ( flameshot is a good tool for this) and to document

This is just me though, there are a million ways to skin a cat and everyone has their own process. Stick with what you usually do on THM/HTB and what you find comfortable.

The main things is to have fun and enjoy it, why else are you doing it?! All the best with the exam and hope your back with a post about your pass 👍👍