PECB Certified Cyber Threat Analyst exam-day guide
PECB Certified Cyber Threat Analyst · Prepare for the day ahead.
Your checklist
Confirm exam format and delivery mode with the provider
PECB exams are typically delivered online with remote proctoring or at an authorized testing center, and the exact format can change. Before you plan anything, verify with PECB or your training partner: the delivery mode you registered for, the exam duration, whether it is open book, the number of questions, and the passing score. Do not rely on second-hand accounts from forums; policies differ by exam version and by registration date.
Valid government-issued photo ID
Bring the original document, not a photocopy or a photo on your phone. The name on the ID must match the name on your registration. If your ID uses a different script or a shortened name, confirm with the provider in advance how name matching is handled, because proctors can refuse entry when names do not match.
Exam access details and confirmation email
Have your registration confirmation, candidate number, exam link, and any session password available in a place you can reach without leaving the testing area. For remote delivery, install and test the proctoring browser or client well before exam day and note the provider's technical support number in case the session fails to launch.
Stable internet connection and a backup option
Remote-proctored exams fail most often because of connectivity. Test your connection at the same time of day as your exam slot, prefer a wired connection or a strong Wi-Fi signal, and have a fallback such as a mobile hotspot. Confirm with the provider whether a disconnection pauses the clock or consumes exam time.
Compliant workspace
Use a quiet, private room with a clear desk, good lighting, and a door you can close. Remove phones, smart watches, notes, second screens, and anything the proctor might flag unless the provider explicitly permits them. Confirm the provider's rules on permitted materials: for open-book exams, check whether printed standards, tabs, and search tools are allowed.
Reference material only if the exam is open book
If the provider confirms the exam is open book, prepare a concise set of your own notes and key framework references (for example ISO/IEC 27035 phases, MITRE ATT&CK tactic names, the cyber kill chain, and the NIST incident response lifecycle) so you can find definitions quickly. If the exam is closed book, do not bring these into the testing area; confirm the rule with the provider first.
Know the scenario-based question style
PECB essay-style exams typically present a scenario followed by questions that ask you to demonstrate understanding, application, and analysis. Practice writing structured answers: state the concept, apply it to the scenario facts, then justify with a risk-based rationale. Time yourself writing full answers by hand or in a plain text editor, depending on the delivery mode.
Timing plan for the question count
Once you know the number of questions and the duration from the provider, divide the time into per-question budgets and reserve the last 10 to 15 minutes for review. Essay questions reward completeness; a partially answered question usually scores better than a perfect answer to one question and blank pages elsewhere.
Analyst mental model sheet (your own, from memory)
Be ready to reason about triage and severity, indicator lifecycle, threat intelligence levels (strategic, operational, tactical, technical), intelligence sharing (for example STIX/TAXII concepts), detection engineering, and incident escalation. This is knowledge you carry in your head; write a one-page summary during preparation, not during a closed-book exam.
Rest, hydration, and a buffer around the slot
Sleep properly the night before, eat beforehand, and keep the hour before the exam free of meetings. For remote delivery, join the check-in early because identity verification and room scans take time. Confirm with the provider how early you should connect.
Backup contact plan (needs_review)
Note the provider's support contact and your training partner's contact in case of a technical failure or a scheduling problem. Whether a failed session can be rescheduled, and under what conditions, is set by the provider; confirm the policy before exam day rather than assuming a retake is automatic.
Plan the day
Re-read the exam blueprint or candidate handbook from the provider and list the domains with their weightings. Spend the remaining study time on weak domains rather than re-reading material you already know. Write two or three full practice answers under timed conditions and compare them against the framework definitions you are using, checking that you cite the right phase, tactic, or control for each scenario.
Run a full technical dry run: launch the proctoring software, test your camera, microphone, and screen sharing, and complete any system check the provider offers. Verify your ID name matches your registration. Read the provider's rules on permitted materials, breaks, and scoring one more time, and note the support number.
Prepare the physical setup: clear the desk, choose the room, charge devices, and set out your ID and any permitted references. Confirm the exam start time in your local time zone, since remote sessions are often scheduled in a different zone. Do light review of key definitions only, then stop studying early and sleep.
Eat, hydrate, and avoid cramming new material. Join the check-in early: complete identity verification and the room scan, close other applications, silence your phone, and tell anyone at home not to disturb you. Keep water within the permitted rules and confirm with the proctor whether it is allowed before the clock starts.
Read the instructions and any scenario carefully before answering. Note the question count and write down your per-question time budget. If the format allows it, skim all questions first to identify the ones that need the most reasoning, then start with a question you can answer confidently to settle in.
Answer in a structured way: define the concept, apply it to the scenario facts, and justify the choice with a risk-based argument. Watch the clock against your budget and move on when a question is consuming too much time; leave a partial answer rather than nothing. If a technical problem occurs, stop and contact the proctor or support immediately rather than trying to fix it silently.
Check that every question has an answer, that multi-part questions have each part addressed, and that your reasoning is visible rather than only a conclusion. Correct obvious errors, but do not rewrite answers you are confident about; late changes often introduce mistakes.
Rules to check
Follow the provider's identity rules exactly: present the original government-issued photo ID you registered with, keep it visible if asked, and do not begin until the proctor confirms your identity. If your documents or name do not match, the proctor may end the session; contact the provider in advance if you expect a mismatch.
Do not use unauthorized materials, devices, or assistance. Whether notes, printed standards, or a second screen are allowed depends on the exam being open or closed book, so confirm with the provider and follow the proctor's instructions. Unauthorized material or communication can lead to invalidation of your result.
Stay within the camera and microphone view for the whole session unless the proctor approves a break. Do not leave the room, and do not let anyone enter. If you need to leave for an emergency, notify the proctor first and understand that the clock may keep running.
Breaks are governed by the provider's rules, not by your own preference. Ask the proctor at the start whether breaks are permitted, whether the clock pauses, and what check-out and check-in require. For shorter sessions, assume no break and plan hydration accordingly.
Scoring is set by the provider. PECB exams are typically scored against defined criteria with a pass mark published in the candidate handbook; confirm the current pass mark and whether results are provisional or final. Do not treat a practice test score as a prediction of your result.
Attempt and retake conditions are provider policy. Confirm how many attempts your registration includes, the waiting period between attempts, and the fee for any additional attempt before you sit the exam, so a poor result does not leave you without a plan.
Keep the content of the exam confidential. Do not record, screenshot, photograph, or share exam questions or scenarios, and do not discuss specific items in public forums. Sharing exam content can breach the code of ethics and invalidate your certification.
If something goes wrong, report it immediately and in writing. Note the time, what failed, and any reference the proctor gives you, then follow up with the provider's support channel. Whether a disrupted session can be rescheduled or re-scored is decided by the provider; confirm the process rather than assuming an outcome.