IR Level I

The blueprint describes a computer-delivered exam built from multiple-choice, multiple-response and scenario-based items. Expect the scenario items to be longer stems with several plausible options rather than one obviously correct answer. Multiple-response items usually require exact selection, so check whether the stem says "choose all that apply" before committing. Confirm the current delivery method and item count with the issuing body.

Most candidates with a year or two of SOC or sysadmin exposure describe it as demanding but fair. The difficulty is concentrated in the scenario items, where you must sequence decisions and justify them, not in terminology recall. If you have never worked an incident end to end, budget extra time on scoping and containment reasoning rather than on frameworks.

Read the fundamentals once for vocabulary, then move straight to detection and analysis, because everything else assumes you can decide what you are looking at. Follow with containment, eradication and recovery, then preparation, which makes far more sense once you know what the plan has to survive. Leave post-incident activity and legal/reporting for last, but do not skip them - they are easy marks that candidates routinely neglect.

Memorising lifecycle phase names without being able to place a real event in the right phase. Confusing containment with eradication, or assuming isolating a host is always the right first move. Ignoring the reporting clock when an incident touches regulated data. And choosing the most aggressive technical action on scenario items without weighing business impact, safety or evidence preservation.

There is no official study-hour figure, so treat any number you see as guesswork. Working analysts generally need several weeks of focused review at a few hours per week; people without response experience should plan considerably more and include hands-on practice. Track your own readiness against the domain weights rather than against a calendar.

Retake rules, waiting periods and any fee for a second attempt are set by the certifying body and are not fixed across cycles. Check its candidate handbook or exam policy page for the current terms before you book, and note whether a waiting period applies after a failed attempt. This page deliberately does not quote a retake policy.

Validity periods and recertification requirements vary and are published by the issuing organisation, not by study sites. Look for a recertification or continuing-education policy on its official site and check whether the credential requires annual maintenance fees or continuing professional education credits. Treat any expiry date quoted in a forum thread as unverified.

General security credentials spread coverage across governance, architecture, cryptography and operations. This one narrows to the response lifecycle: what you do from the moment an event is escalated to the moment the lessons-learned review closes. That makes it more useful for SOC and CSIRT roles and less useful as a broad first certificate.

You are not tested on a specific product, so vendor certifications are not a substitute and are not required. What helps is familiarity with the underlying artefacts - log sources, endpoint telemetry, network indicators, ticket trails. If you have only read about these, build a small home lab or work through public incident walkthroughs before sitting the exam.

Item count, appointment length, fee, passing score and delivery options are published by the certifying body and change between cycles, so this page does not reproduce them. Go to the official certification site, open the exam handbook or blueprint for the current year, and use those figures when you schedule. Cross-check the domain weightings against the blueprint version you are studying.