CTDC study guide
CTDC · Work through your exam, one topic at a time.
The Certified Threat Detection and Countermeasures (CTDC) credential is aimed at security operations practitioners who detect, triage, and respond to intrusions rather than at governance or audit roles. Typical candidates are SOC analysts moving from tier-one alert handling to deeper investigation, detection engineers, incident responders, and network or endpoint administrators who share on-call rotation duties. The CTDC study guide has 8 sections and about 3,524 words.
01Network Threat Detection and Traffic Analysis
Network Threat Detection and Traffic Analysis tests whether you can convert packets, flows and protocol metadata into findings you can defend - and explain why a pattern is malicious rather than merely unusual. Items combine IDS rule logic, behavioral analytics (beaconing, tunneling, exfiltration) and the hard visibility limits set by encryption and sensor placement.
477 words, about 2 min02Endpoint Detection and Response
Endpoint Detection and Response tests whether you can read process-level telemetry correctly, recognize credential access and defense evasion as they happen, and choose a response action that preserves evidence. Items favor lineage reasoning over signature recall.
434 words, about 2 min03Log Collection, SIEM Correlation, and Alert Triage
Log Collection, SIEM Correlation, and Alert Triage tests whether you can onboard the right telemetry, normalize it into a common schema, correlate it into something meaningful, and decide within minutes whether an alert is real. Items reward precise knowledge of event semantics over generic SIEM vocabulary.
467 words, about 2 min04Threat Intelligence and Indicator Management
Threat Intelligence and Indicator Management tests whether you can take a feed, decide what it is worth, deploy it without breaking the business, and retire it before it rots. Items focus on lifecycle discipline and the difference between context and blocking.
435 words, about 2 min05Adversary Tactics, Techniques, and Procedures (MITRE ATT&CK)
The MITRE ATT&CK domain tests whether you can use the framework as an engineering tool rather than a poster. Items ask you to place behavior at the right tactic, cite the right technique identifier, and convert coverage claims into honest gap analysis.
409 words, about 2 min06Incident Detection, Escalation, and Response Workflow
This domain tests the mechanics of moving an alert to a closed incident: severity assignment, escalation tiers, containment decisions, evidence handling and notification obligations. Items reward process precision under pressure, not heroics.
446 words, about 2 min07Countermeasures, Hardening, and Mitigation Controls
Countermeasures, Hardening, and Mitigation Controls tests whether you can choose the control that actually removes an attack path, implement it without breaking production, and explain the residual risk when you cannot. Items favor specific configuration knowledge over the word 'defense in depth'.
420 words, about 2 min08Detection Engineering, Tuning, and False Positive Reduction
Detection Engineering, Tuning, and False Positive Reduction tests whether you can treat detections as versioned, testable software and reduce noise without blinding yourself. Items reward disciplined tuning levers over simply raising thresholds.
436 words, about 2 min