LogRhythm LRSA exam-day guide
LogRhythm LRSA · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Bring the same ID name that matches your registration exactly. If you are testing remotely, the proctor will compare the name on the ID to the registration before releasing the exam. If you are unsure which ID forms your testing provider accepts, confirm with the provider before test day.
Exam confirmation and scheduling details
Have your appointment confirmation, registration number, and the provider's support phone number saved offline (screenshot plus a note on your phone) in case you need to reach support during check-in.
Know your delivery format
Confirm whether you are taking the LRSA exam at a test center or via remote proctoring, and confirm the exact start time in your local time zone. Format and time-zone handling vary by provider, so verify rather than assume.
Test your computer and network (remote only)
Run the provider's system check on the same machine and network you will use on exam day, at least 24 hours ahead. Wired Ethernet or a stable connection is preferable; close bandwidth-heavy apps. If the system-check tool flags anything, resolve it before the 24-hour mark.
Webcam, microphone, and speakers working
Remote proctoring typically requires a working webcam, mic, and speakers or headset. Test them in the system check. If you are unsure whether headsets are permitted, confirm with the provider.
Clear, private room
Remote sessions usually require a quiet, private room with a cleared desk, no second monitor, and no notes or devices within reach unless explicitly allowed. Remove papers, phones, and smart devices from the desk area before check-in.
Review the exam blueprint and your weak domains
Re-read the official LRSA exam objectives and list the domains you score lowest on in practice. Spend the final days on those domains rather than re-reading material you already know.
Rehearse LogRhythm workflows hands-on
Practice the tasks you will be tested on conceptually: navigating the Client Console, building and tuning rules, working with lists and SmartResponse, reviewing alarms and cases, and interpreting dashboards. Hands-on familiarity with the UI makes recall questions much faster.
Prepare a one-page formula and terminology sheet
Condense key definitions (e.g., MPE, AI Engine, rule types, log source types, alarm vs. case workflow) onto a single page for last-minute review. Note: confirm with the provider whether any reference material is permitted during the exam; do not bring it into the session unless allowed.
Plan food, water, and medication
Eat a normal meal before the session and keep water nearby if the provider permits it at the desk. Confirm break rules in advance, since unscheduled breaks may not be allowed in remote sessions.
Charge devices and have a backup plan
Charge your laptop and phone. For remote exams, have a phone available as a backup contact for support and a second way to reach the provider if your primary connection fails.
Read the candidate agreement
Review the provider's candidate handbook and non-disclosure terms before test day. Confirm with the provider what is and is not allowed regarding notes, breaks, and scratch materials.
Plan the day
Do a full timed practice set or mock exam under exam-like conditions. Score it, identify the two or three domains with the lowest accuracy, and write a short study plan for those domains only. Stop learning brand-new topics after this point; consolidation beats breadth in the final days.
Work through your weakest domains with hands-on practice in a LogRhythm lab or demo environment. Focus on rule creation and tuning logic, alarm and case handling, list management, and reading dashboards. Write down the exact UI paths and terminology you keep forgetting.
Run the provider's system check on your exam machine and network (remote candidates). Confirm your appointment time, time zone, and delivery format. Locate your ID and confirm the name matches your registration. If anything is unclear about ID, breaks, or permitted materials, contact the provider now rather than the morning of.
Light review only: your one-page terminology sheet and the official exam objectives. Do not cram new material. Prepare your desk and room, charge devices, set two alarms, and get a full night of sleep. Confirm the exact check-in time and how early you should log in or arrive.
Eat a normal meal, hydrate, and avoid heavy last-minute cramming. Do a five-minute review of your terminology sheet. For remote exams, close all other applications, clear your desk, and start the check-in process early so proctor verification does not eat into your exam time.
Read each question fully and watch for qualifiers like 'BEST', 'FIRST', or 'EXCEPT'. Answer easy questions first and flag long scenario items to revisit. For scenario questions, identify what the analyst is trying to accomplish before choosing a tool or workflow. If a question stalls you, eliminate two options and move on; do not let one item consume minutes.
Use remaining time to revisit flagged questions and confirm you have answered every item; unanswered questions usually score as incorrect. Only change an answer if you have a concrete reason. Submit, then note your provisional result if the provider displays one.
Rules to check
Bring government-issued photo ID with a name that exactly matches your registration. If you are unsure which ID forms are accepted, confirm with the provider before test day.
Follow all proctor instructions and the candidate agreement, including non-disclosure of exam content. Do not discuss, reproduce, or share specific exam questions after the session.
Do not bring unauthorized materials into the testing environment. Whether notes, scratch paper, or reference sheets are permitted varies by provider; confirm with the provider in advance rather than assuming.
Break availability and rules differ between test-center and remote delivery. Confirm with the provider how breaks are handled and whether the clock stops; do not leave the camera or testing area without permission.
Scoring details such as pass mark, scaled score range, and whether items are weighted are set by the certification body. Do not rely on secondhand claims; confirm the current scoring policy with the provider.
If a technical problem occurs during a remote session, stay calm, note the time, and contact provider support immediately. Do not attempt to fix the proctoring software in ways the proctor has not authorized.
Arrive or log in early per the provider's instructions. Late arrival may forfeit your seat or appointment depending on provider policy; confirm the cutoff with the provider.