CTDC

It uses multiple-choice and multiple-response items, including scenario questions built around partial evidence such as a log excerpt or alert description. Multiple-response items typically tell you how many answers to select, so read that instruction before committing. The official body publishes the current item count and delivery method on its site.

Candidates with real SOC or IR experience usually find the detection and triage domains comfortable and struggle with detection engineering and ATT&CK mapping nuance. Those who have only read about tools tend to fail on scenario items that require interpreting incomplete evidence. Depth of reasoning matters more than recall of product interfaces.

No. Questions test concepts that transfer across SIEM, EDR, and network monitoring platforms: log source behavior, correlation logic, indicator lifecycle, and response sequencing. Vendor-neutral understanding is what is assessed. If you know one platform deeply, translate that knowledge into general principles rather than memorizing menus.

Start with network and endpoint telemetry so you know what evidence exists, then move to log collection and SIEM correlation, since tuning depends on understanding sources. Add threat intelligence and ATT&CK next, because both shape detection logic. Finish with response workflow, hardening, and detection tuning, which draw on everything before them.

Treating every alert as a true positive, ignoring baseline and context, and jumping to containment before scoping. Another frequent error is confusing an indicator's presence with compromise, or mapping behavior to the wrong ATT&CK tactic. Candidates also lose points by selecting every plausible control instead of the one that addresses the stated gap.

Those figures change and are set by the certifying organization, so check its official site for the current duration, fee, and appointment availability. Do not rely on numbers quoted in forums or training blogs, which are often outdated. Plan your booking only after confirming the current published details.

The official body publishes the current passing standard and any retake rules, including waiting periods and fees. Confirm both on its site before you schedule, since these policies are revised periodically. Preparing as if you have one attempt is the safest approach regardless of the stated policy.

Enough to have seen a detection fail. Build a small lab with a SIEM ingesting endpoint and firewall logs, write a rule, then deliberately trigger and suppress false positives. Practice tracing one simulated intrusion from initial alert through scoping and containment. A few focused lab cycles beat passive reading.

It is a knowledge credential, not a license or a guarantee of employment. It signals that you understand detection and response concepts at a tested level. Employers still assess hands-on skill. This page is independent study material and is not affiliated with or endorsed by the certifying organization.