DSTC study guide
DSTC · Work through your exam, one topic at a time.
The DSTC is a defensive security certification aimed at practitioners who need to detect, investigate, and respond to threats rather than simply build controls. It suits SOC analysts, security engineers moving into operations, and IT administrators who have inherited monitoring duties. The exam is multiple choice and spans six domains: security fundamentals and the threat landscape, network security and architecture, endpoint and host security, identity and access management, incident detection and response, and security operations, governance, and compliance. The weighting is broad rather than deep - roughly a fifth each on fundamentals and network security, with the remaining domains split more evenly - so candidates are expected to reason across domains rather than specialise in one. The DSTC study guide has 6 sections and about 1,994 words.
01Security Fundamentals and the Threat Landscape
Security rests on the CIA triad: confidentiality, integrity, and availability. Every control you meet can be classified by which of these it protects, and by whether it is preventive, detective, or corrective.
305 words, about 2 min02Network Security and Architecture
Understand the OSI and TCP/IP models and where controls sit. Firewalls filter by stateful inspection or stateless rules; next-generation firewalls add application awareness.
284 words, about 1 min03Endpoint and Host Security
Endpoint protection has evolved from signature-based antivirus to endpoint detection and response (EDR) that watches behavior. Understand host hardening: patching, disabling unused services, removing default accounts, and applying least privilege.
289 words, about 1 min04Identity and Access Management
IAM answers who can access what, and how that is proven and enforced. Authentication verifies identity (something you know, have, or are); authorization decides permissions; accounting logs activity.
277 words, about 1 min05Incident Detection and Response
Incident response follows a lifecycle: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Memorize the order, because questions test sequencing.
280 words, about 1 min06Security Operations
Security operations is the day-to-day execution of security: monitoring, triage, tuning, and continuous improvement. Understand the SOC roles and the value of a runbook for repeatable response.
559 words, about 3 min