CDSA practice examsIn development
HTB Certified Defensive Security Analyst
Security operations examined by doing it: the SOC turning a flood of events into a few correct decisions with ATT&CK as shared vocabulary, baselining normal so abnormal is recognisable, telemetry from Windows events, Sysmon, EDR and network sources with detection bounded by what is collected, and SIEM correlation and tuned detections; then proportionate triage, evidence-led investigation building a timeline whose driving question is scope, threat hunting that produces new detections, an incident response lifecycle that establishes scope before containing and removes persistence before recovering, and a graded report proving the response was complete.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| The SOC, telemetry and detection | Not published |
| Investigation, incident response and reporting | Not published |
Two sample questions
1. What does a timeline built during an investigation establish?
- The period over which the available telemetry covers the systems involved
- The interval between the intrusion beginning and the point it was discovered
- The sequence of events across sources, showing how the intrusion progressed — correct
- The order in which the evidence was collected during the acquisition phase
Why: Ordering events from all available sources is what turns isolated findings into an account of what happened, including where the intrusion began.
2. What does an EDR agent primarily monitor?
- Endpoint process and system activity — correct
- The building's physical access doors
- The SIEM's storage utilisation
- The analysts' login times
Why: EDR watches endpoint behaviour such as process execution and file changes to detect threats on hosts.
The real CDSA exam
| Length | 7 days |
|---|---|
| Questions | Practical: an investigation scenario scored on findings plus a graded report |
| Pass mark | A defined findings threshold and an acceptable incident report |
| Price | Included with the academy path subscription; a voucher is issued on completion |
| Recommended before you sit it | Completion of the SOC analyst path in the HTB Academy. |
| Valid for | Does not expire |
Exam facts as published by Hack The Box; always check the vendor’s page before you book.
Study CDSA with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.