PECB Certified Cyber Threat Analyst common mistakes
PECB Certified Cyber Threat Analyst · Understand the traps and how to avoid them.
Treating threat hunting as synonymous with threat intelligence consumption or with alert triage, so answers describe 'investigating the SIEM queue' rather than a hypothesis-driven hunt.
Candidates come from SOC operations backgrounds where reactive alert handling dominates daily work, so they map unfamiliar hunting concepts onto familiar triage routines.
What to do instead
Memorise the defining attributes of a hunt: a formulated hypothesis, proactive search independent of existing alerts, use of TTP-based indicators, and a documented outcome (detection, no-finding, or new analytic). When a question asks what distinguishes hunting from monitoring, eliminate any option that is triggered by an alert or feed.
Confusing the threat hunting maturity levels, answering that an organisation at the initial level already performs data-driven or automated hunts.
The maturity ladder (initial, minimal, procedural, innovative, leading) is easy to memorise as a list but hard to apply, and candidates assume 'we have a SIEM' equals a high level.
What to do instead
Anchor each level to a concrete capability: initial = relies on threat intelligence feeds and IOC searches only; minimal = uses high-level TTPs and some data collection; procedural = follows documented, repeatable hunt procedures; innovative = uses advanced analytics and automation; leading = automates most hunts and feeds findings back into detection engineering. Practise classifying short scenarios into levels.
Writing a hunt plan that starts with tooling selection and data sources rather than with scope, hypothesis, and success criteria.
Practitioners are used to implementation-first thinking, and exam scenarios describing 'you are asked to build a hunt programme' invite tool listing.
What to do instead
Structure the preparation phase in order: define objectives and scope, identify the hypothesis and threat model (which adversary, which TTP), determine required data sources and their quality, define success criteria and reporting, then select tooling. If an answer option begins with acquiring a new platform before scoping, it is usually wrong.
Designing an incident management plan without defining escalation thresholds, roles, and communication paths, treating the plan as just a list of technical steps.
Technical candidates focus on containment commands and forget that plans fail on decision rights and notification obligations.
What to do instead
For any plan-design question, check that the answer covers severity classification criteria, named roles (incident commander, communications lead, legal liaison), escalation triggers and timelines, internal and external notification requirements, and evidence handling. Reject options that omit authority or communication elements.
Skipping or misordering the knowledge phase: jumping from raw hunt data straight to closing the case without documenting findings, updating analytics, or feeding results back into the programme.
The knowledge phase feels administrative, and candidates under time pressure treat documentation as optional output rather than a required stage.
What to do instead
Remember that the knowledge phase converts hunt output into organisational value: document the hypothesis, data reviewed, findings, false positives, new detection content, lessons learned, and metrics. Expect questions where the 'best next step' after a completed hunt is to create or tune a detection analytic and update the threat model, not to close the ticket.
Confusing the purpose of the ATT&CK-style tactic and technique layers, for example answering that a technique describes the adversary's goal rather than how it achieves it.
Tactics and techniques are learned as two lists without the 'why versus how' relationship, and similar-sounding names create interference.
What to do instead
Use the rule 'tactic = the why/goal, technique = the how/action'. When a question names something like credential dumping or phishing, classify it as a technique; when it names something like persistence or exfiltration, classify it as a tactic. Practise mapping techniques to their parent tactic.
Treating preventive, detective, and corrective controls as interchangeable, or claiming a single control satisfies a requirement when the question asks for defence in depth.
Control categories overlap in real environments (logging is detective but also supports correction), and candidates pick the control they know best rather than the one matching the stated objective.
What to do instead
For each question, first identify the objective verb: prevent, detect, correct, or compensate. Then select the control class that matches, and where the scenario asks for layered protection, choose the answer that combines categories rather than one control.
Approving or describing emergency changes without the retrospective review and documentation step, or assuming change management can be bypassed during an incident.
Incident urgency makes 'skip the process' feel operationally realistic, and candidates answer from habit rather than from governance principles.
What to do instead
Recall that emergency changes still require authorisation by a designated authority, a record of what was changed and why, and a post-implementation review to formalise or roll back the change. Choose answers that preserve accountability even under time pressure, and reject options that leave undocumented changes in place.
Describing security culture as awareness training completion rates or as a communications campaign, rather than as measurable behaviour and shared values reinforced by leadership.
Awareness and culture are colloquially used interchangeably, and training metrics are the easiest artefacts to cite.
What to do instead
Distinguish the two: awareness is knowing, culture is doing and valuing. Strong answers reference leadership modelling, incentives and consequences, reporting behaviour (e.g. phishing report rates, near-miss reporting), and integration of security into business processes. Treat completion percentage alone as a weak indicator when a question asks how to build or assess culture.
Choosing vanity metrics (number of alerts, number of hunts performed) instead of outcome-oriented measures, and failing to link measurement to continual improvement actions.
Volume metrics are readily available from tools, and candidates equate activity with effectiveness.
What to do instead
Prefer measures tied to outcomes and decisions: mean time to detect and respond, percentage of hunts that produced new detections, false positive rate, coverage of priority techniques, and trend of repeat incidents. Pair every metric with a defined review cycle and a corrective action path, since the exam tests the improvement loop, not just reporting.