DSTC
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The DSTC is a defensive security certification aimed at practitioners who need to detect, investigate, and respond to threats rather than simply build controls. It suits SOC analysts, security engineers moving into operations, and IT administrators who have inherited monitoring duties. The exam is multiple choice and spans six domains: security fundamentals and the threat landscape, network security and architecture, endpoint and host security, identity and access management, incident detection and response, and security operations, governance, and compliance. The weighting is broad rather than deep - roughly a fifth each on fundamentals and network security, with the remaining domains split more evenly - so candidates are expected to reason across domains rather than specialise in one. Preparation works best in layers: solidify terminology and attack-lifecycle concepts first, then work through each domain's tooling and controls, and finish with scenario practice where you must choose the best response under ambiguity. Hands-on familiarity with logs, alert triage, and access-control decisions matters more than memorising product names. This page is an independent study resource and is not affiliated with or endorsed by the certifying body; always confirm current exam details with the official provider.
What you'll study
About DSTC preparation
What is the DSTC actually testing?
Applied defensive judgement. Questions are framed around real operational choices - which control to apply, which alert to escalate, which identity model fits a scenario - rather than isolated definitions. Expect to weigh trade-offs, not just recall terms.
How is the exam formatted?
The format is multiple choice. The official body publishes the current question count, time limit, and delivery options on its website, and those details change between versions, so check there rather than relying on secondhand figures.
How long should I plan to study?
Most candidates with existing IT or security experience need several weeks of structured study across all six domains, with extra time on the two heaviest ones. If you are new to security operations, budget considerably more and build hands-on log and triage exposure alongside reading.
What score do I need to pass, and what does it cost?
Passing scores and fees are set by the certifying organisation and are revised periodically. They are not fixed constants, so consult the official DSTC page for the current passing threshold, registration fee, and any regional pricing before you book.
Can I retake the exam if I fail?
Retake rules, waiting periods, and any additional fees are defined by the certifying body and vary by version and region. Check the official policy page before scheduling so you know how a second attempt affects your timeline and budget.
What is the most common reason candidates fail?
Studying domains in isolation. The exam rewards cross-domain reasoning - for example, connecting an identity weakness to a detection gap and then to a response step. Candidates who memorise tool lists but cannot sequence an investigation tend to lose marks on scenario items.
In what order should I study the domains?
Start with fundamentals and the threat landscape to build shared vocabulary, then network and endpoint security, then identity and access management. Finish with detection and response and with operations, governance, and compliance, since those domains assume the earlier material.
Do I need hands-on experience?
Not formally, but it helps significantly. Reading logs, triaging alerts, and making access-control decisions in a lab or at work makes scenario questions far easier. If you lack that background, build a small home lab and practise interpreting events before exam day.
How current is the threat content?
Concepts such as attack lifecycle stages, defence in depth, and least privilege age well; specific malware families and tool versions do not. Study durable principles and be ready to apply them to unfamiliar technologies rather than memorising named threats.
Is this page official?
No. It is an independent study overview and is not affiliated with, endorsed by, or sponsored by the certifying body. Verify all administrative details - eligibility, format, scheduling, and policies - directly with the official provider.