CSA (EC-Council Certifications) study guide
CSA · Work through your exam, one topic at a time.
The Certified SOC Analyst (CSA) credential is aimed at people who work - or want to work - on a security operations centre's front line: tier-one and tier-two analysts, and the network or systems administrators who increasingly absorb monitoring duties. It tests whether you can recognise an attack in progress and respond to it in a disciplined way, rather than whether you can configure a specific vendor product. The CSA study guide has 6 sections and about 2,324 words.
01Security Operations and Management
Security operations is the day-to-day machinery that keeps detection and response running: people, process, and tooling organized around a defined scope. Candidates must understand the operating model (in-house SOC vs.
338 words, about 2 min02Understanding Cyber Threats, IoCs, and Attack Methodology
This domain tests whether you can reason about who attacks, how they progress, and what evidence they leave. Know the threat actor taxonomy: nation-state/APT (patient, well-resourced, espionage), organized crime (financially motivated, ransomware), hacktivist (ideological, defacement/DDoS), insider (authorized access, hardest to detect), and script kiddie (commodity tooling).
327 words, about 2 min03Incident Detection with SIEM
A SIEM aggregates logs, normalizes fields, correlates events, and alerts. Candidates must understand the pipeline: collection → parsing/normalization → enrichment → correlation rules → alerting → triage .
306 words, about 2 min04Log Management
Log management is the lifecycle: generation → collection → transport → storage → retention → analysis → disposal . Candidates must know why each stage matters to investigations and compliance.
295 words, about 1 min05Network and Endpoint Security
This domain covers the defensive controls at the network and host layers and how they complement each other. Network controls: firewalls (stateful vs.
269 words, about 1 min06Incident Response and Forensics
Incident response follows a lifecycle: Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned . Know the order and what belongs in each phase.
789 words, about 4 min