HTB CDSA

It is a practical assessment in a live environment rather than a multiple-choice test. You receive defensive security scenarios, investigate them using real tools, and then submit a report describing your findings, evidence, and conclusions. Expect to spend as much effort documenting your reasoning as you do running commands.

The difficulty comes from ambiguity, not trivia. You are not recalling definitions; you are deciding which logs matter, which host to triage next, and how to prove a conclusion. Candidates comfortable in a terminal and with SIEM queries generally find it manageable, while those who have only studied concepts often run out of time.

The certifying body sets the current duration, fee, and scheduling windows, and these change over time. Check the official HTB Academy or certification page for the authoritative figures before you plan. Do not rely on forum posts or older blog write-ups, which frequently quote outdated numbers.

Retake rules, waiting periods, and any associated costs are defined by the certifying organization and can be revised. Consult the official certification page for the current policy rather than assuming a fixed number of attempts. Budget time for a second attempt in your study plan so a setback does not derail your schedule.

Start with log analysis and SIEM fundamentals, because nearly every other domain depends on reading telemetry. Then move to network traffic and host/EDR analysis, followed by forensics and malware handling. Layer in Active Directory and Windows monitoring throughout, and practice report writing from day one rather than saving it for the end.

Three patterns dominate: poor time management from chasing every alert instead of prioritizing, weak documentation that fails to connect evidence to conclusions, and shallow tool knowledge that collapses when the environment differs from a walkthrough. Practicing under a timer and writing reports for every lab you complete addresses all three.

You need practical triage, not full reverse engineering. Being able to identify suspicious behavior, extract indicators, and explain what a sample appears to do from static and dynamic clues is usually enough. Deep disassembly skills help but are not the primary focus of a defensive analyst role.

It matters a great deal. A correct technical finding that is poorly explained, unsupported by evidence, or missing impact and remediation guidance earns little. Write as you investigate, capture screenshots and command output, and structure findings so a reader who was not present can follow your reasoning.

Strongly recommended. Candidates who have built a home lab, worked with a SIEM, and analyzed real packet captures and host artifacts are far better prepared than those who only completed guided exercises. Aim for scenarios where you must decide what to investigate without being told the answer.