CSA (EC-Council Certifications)
Certified SOC Analyst (CSA)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Certified SOC Analyst (CSA) credential is aimed at people who work - or want to work - on a security operations centre's front line: tier-one and tier-two analysts, and the network or systems administrators who increasingly absorb monitoring duties. It tests whether you can recognise an attack in progress and respond to it in a disciplined way, rather than whether you can configure a specific vendor product. The published blueprint splits roughly into six areas: security operations and management; cyber threats, indicators of compromise and attack methodology; detection using SIEM, log management and network/endpoint security controls; incident response and forensics; network security and traffic analysis; and incident reporting and communication. Preparation works best in that order. Build vocabulary around the attack lifecycle and log sources first, then practise reading packet captures, firewall and proxy logs, and SIEM alerts until you can describe what happened in plain language. Hands-on time with a free SIEM, a packet analyser and a lab network teaches more than reading alone. Confirm current exam logistics - length, format, fee, passing score - with the certifying body, since it publishes the authoritative figures and revises them periodically. This guide is independent study material and is not affiliated with or endorsed by the certification body.
What you'll study
About CSA preparation
What format is the CSA exam?
It is a multiple-choice exam delivered as computer-based testing. The certifying body publishes the current question count, time allowance and delivery options on its own website; check there before booking, because those details change between revisions of the blueprint.
How long is the exam and how many questions are there?
Those figures are set by the certification body and are not fixed forever. Rather than rely on a number from a study guide, confirm the current question count and duration on the official site when you schedule your appointment.
What score do I need to pass, and what does it cost?
The passing score and exam fee are published by the certifying body and can change. Look them up on the official site at the time you register. Any figure quoted in third-party material may be out of date.
How hard is it in practice?
Most candidates find the threat and detection domains manageable and the log-analysis and forensics questions harder, because they require reading evidence rather than recalling definitions. If you have never looked at a packet capture or a proxy log, expect to spend real time on those before sitting the exam.
Can I retake it if I fail?
Retakes are generally permitted, but the number of attempts, the waiting period between them and any additional fee are set by the certifying body. Check its policy page before you book so you know your options and budget.
In what order should I study the domains?
Start with attack methodology and indicators of compromise - everything else depends on that vocabulary. Then move to log sources and SIEM detection, followed by network and endpoint analysis. Leave incident response, forensics and reporting for last, since they assume you already recognise what you are responding to.
Why do candidates fail?
The usual causes are memorising tool menus instead of understanding evidence, skipping hands-on practice with logs and packet captures, and misreading questions that ask what to do first or next. In incident handling, sequence matters; the technically strongest action is often not the correct first step.
Do I need work experience to sit the exam?
There is typically no formal prerequisite, but the material assumes familiarity with TCP/IP, common operating systems and basic security concepts. If you lack that background, build it first - otherwise the detection and analysis domains will be difficult to absorb.
How much hands-on practice do I need?
Enough to be comfortable, not expert. Set up a small lab, generate traffic, capture it, and write up what you see. Practise querying a SIEM and correlating an alert with firewall and proxy logs. A few focused lab sessions beat months of passive reading.
Does this guide come from the certification body?
No. This is independent study material produced by a third party. It is not affiliated with, endorsed by or approved by the certifying organisation, and it does not reproduce any official question bank. Always treat the official website as the authority on exam logistics.