ATSA study guide
ATSA · Work through your exam, one topic at a time.
The ATSA is a multiple-choice certification exam aimed at security practitioners who need to demonstrate breadth across defensive and offensive-adjacent operations rather than depth in a single tool. It suits SOC analysts, junior-to-mid security engineers, network administrators moving into security, and GRC staff who want a common technical vocabulary. The ATSA study guide has 8 sections and about 3,489 words.
01General Security Concepts
This domain tests whether you can describe security in the language of principles, guarantees, and control classifications rather than products. Expect items that ask you to name the property a mechanism provides, classify a control on two independent axes, or identify the design principle that a failure violated.
464 words, about 2 min02Network Security
This domain tests segmentation decisions, where security devices sit in the traffic path, protocol selection, and how wireless and remote users are authenticated. Questions usually hinge on the operational consequence of a placement choice, not on the device's marketing category.
505 words, about 3 min03Security Operations and Monitoring
This domain tests telemetry selection, detection engineering, alert triage, and the metrics that prove a SOC works. Most items ask which data source would actually answer a question, or which detection logic would catch a described behavior without drowning the queue.
424 words, about 2 min04Vulnerability Management
This domain tests the full lifecycle - knowing what you own, measuring weakness, deciding what to fix first, and proving the fix. The exam rewards risk-based prioritization over raw scores and punishes treating a scanner report as a list of confirmed exploits.
401 words, about 2 min05Incident Response and Threat Hunting
This domain tests the response lifecycle, evidence integrity, and hypothesis-driven hunting. The strongest discriminator on the exam is ordering: what you do first determines whether you can still investigate afterward.
411 words, about 2 min06Security Architecture and Engineering
This domain tests secure design principles, cloud responsibility boundaries, cryptographic engineering, and resilience. Items typically describe a system and ask who owns a control, or which principle a design violates.
431 words, about 2 min07Identity and Access Management
This domain tests authentication factors, federation protocols, authorization models, and the identity lifecycle. Many items turn on a precise protocol distinction - especially OAuth versus OIDC and RADIUS versus TACACS+.
412 words, about 2 min08Risk Management and Compliance
This domain tests risk vocabulary, quantitative analysis, treatment decisions, and how frameworks and regulations map to controls. Expect calculation items and questions that ask who must own or approve a decision.
441 words, about 2 min