CISP-TRE study guide
CISP-TRE · Work through your exam, one topic at a time.
CISP-TRE (Certified Information Security Professional – Threat Response and Engineering) is a vendor-neutral credential aimed at defenders who do more than triage alerts: analysts, incident responders, detection engineers, and SOC staff who build and run the tooling that catches and contains intrusions. The exam is delivered in Chinese and tests nine domains, weighted toward threat intelligence and analysis, threat hunting and detection engineering, and incident response and handling (15% each), with smaller blocks on malware analysis and reverse engineering fundamentals, network security monitoring and traffic analysis, endpoint detection and response, SOC operations and automation, digital forensics and evidence handling, and threat response engineering and tooling. The CISP-TRE study guide has 9 sections and about 4,012 words.
01Threat Intelligence and Analysis
This domain tests whether you can turn raw reporting and telemetry into a decision someone acts on. Expect questions on the intelligence cycle, the difference between atomic indicators and adversary behaviour, the models used to structure analysis, and the handling rules that govern sharing.
455 words, about 2 min02Threat Hunting and Detection Engineering
This domain tests hypothesis-driven hunting and the disciplined conversion of a hunt finding into a maintained detection rule. You should be able to name the data sources a hypothesis requires, write rule logic that is testable, and explain how false positives are tuned rather than silenced.
454 words, about 2 min03Incident Response and Handling
This domain tests the full incident lifecycle and the judgement calls inside it: when to contain, what to preserve, who to notify and how you prove the incident is closed. Questions frequently present a scenario and ask for the next correct action rather than a definition.
439 words, about 2 min04Malware Analysis and Reverse Engineering Fundamentals
This domain tests whether you can safely characterise a sample far enough to support detection and response, and whether you know which questions static and dynamic methods can each answer. It is fundamentals, not expert reversing: expect file format, packing, behavioural artifacts and lab safety.
441 words, about 2 min05Network Security Monitoring and Traffic Analysis
This domain tests your ability to find adversary activity in network evidence: full packet capture, flow records, transaction logs and IDS alerts. The exam favours questions where you must choose the right data source for a question, and where you must reason about behaviour rather than match a signature.
457 words, about 2 min06Endpoint Detection and Response
This domain tests endpoint telemetry literacy: which events answer which question, how process ancestry exposes an attack, and what live response actions are available and when to use them. Questions commonly show a process tree or an event excerpt and ask for the assessment.
448 words, about 2 min07Security Operations Center (SOC) Operations and Automation
This domain tests how a SOC runs as a production function: tiered triage, documented disposition, measured performance, tuned detection content and automation that does not create new risk. Expect scenario questions about what an analyst should do next and what a metric actually measures.
407 words, about 2 min08Digital Forensics and Evidence Handling
This domain tests whether your evidence survives scrutiny: lawful acquisition, integrity proof, documented custody, and analysis that distinguishes what an artefact proves from what it merely suggests. Expect questions on acquisition order and on specific Windows artefacts.
445 words, about 2 min09Threat Response Engineering and Tooling
This domain tests the engineering side of response: building repeatable, safe mechanisms to sweep, contain and verify across an estate instead of acting host by host. Questions tend to ask what a scripted action will actually do, what could go wrong, and how success is verified.
466 words, about 2 min