Home / cybersecurity / EC-Council Certified SOC Analyst (CSA v2, Exam 312-39) / Cheat Sheet
EC-Council Certified SOC Analyst (CSA v2, Exam 312-39)· Exam reference card · 2026 · Edureify AI
EC-Council Certified SOC Analyst (CSA v2, Exam 312-39)

EC-Council CSA Cheat Sheet

EC-Council CSA Tests Triage, Tuning and Response Order — Not Memorised SIEM Vendor Menus

CSA v2 targets tier 1 and tier 2 SOC analysts. Half the exam is detection, triage and incident response, so learn to pick the next correct step, not the most aggressive one.

Check Your Readiness →
Among the harder certs
Avg: Not published by EC-Council
Pass: 750 / 1000
Most candidates understand EC-Council Certified SOC Analyst (CSA v2, Exam 312-39) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Core Framework

EC-Council CSA v2 (312-39) Blueprint Domain Map

The v2 blueprint replaced v1 weights still quoted online. Stems usually show evidence (a log line, alert, header or hunt) and ask what it is or what comes next. Answers favour the least destructive effective action and process fixes such as tuning over adding headcount or tools.

  1. 01
    Incident Detection and Triage (25%) — SIEM correlation, use cases, true/false positives, AI-drafted rules, SOC reports
  2. 02
    Incident Response (25%) — phase order, containment before eradication, phishing purge, insiders, EDR vs. XDR, playbooks
  3. 03
    Log Management (15%) — Windows event IDs, logon types, auth.log, syslog severity and transport, NTP
  4. 04
    Proactive Threat Detection (12%) — intel types, STIX/TAXII, TLP, hunting approaches, YARA and Get-WinEvent
  5. 05
    Cyber Threats, IoCs and Attack Methodology (8%) — Pyramid of Pain, Kill Chain, ATT&CK, spraying, BEC
  6. 06
    Security Operations and Management (5%) — SOC tiers, sourcing models, maturity, MTTD vs. MTTR
  7. 07
    Forensics Investigation and Malware Analysis (5%) — volatility order, custody, NetFlow vs. PCAP, static vs. dynamic
  8. 08
    Introduction to Cloud SOC (5%) — Sentinel, Defender for Cloud, CloudTrail, GuardDuty, Security Hub, SCC
Scenario Traps

Wrong instinct vs correct approach

A credential-phishing email reached 240 mailboxes; three users clicked and one entered credentials
✕ Wrong instinct

Delete the message from the five reporting users' inboxes

✓ Correct approach

Purge the message organization-wide and block the URL, then for the user who submitted credentials revoke sessions and tokens, reset the password and check for malicious forwarding or hiding inbox rules.

Attackers stayed undetected for about 40 days, but containment after detection took under two hours
✕ Wrong instinct

Focus leadership on reducing mean time to respond

✓ Correct approach

Dwell time before detection is MTTD, which reflects visibility and detection coverage. MTTR starts only after detection and is already good here, so the fix is new log sources, use cases and hunting.

A file server shows a six-hour gap in its Security log; the SIEM copy shows event 1102
✕ Wrong instinct

Log rotation or routine maintenance cleared the log

✓ Correct approach

1102 means the Security audit log was cleared, a classic anti-forensics step, here under a domain admin account. Treat it as an incident, trust the forwarded copy and investigate that account's activity.

An Azure customer needs one service correlating Entra ID, activity and firewall logs with automated playbooks
✕ Wrong instinct

Microsoft Defender for Cloud with its secure score

✓ Correct approach

Microsoft Sentinel is the SIEM and SOAR: analytics rules in KQL over a Log Analytics workspace and Logic Apps playbooks. Defender for Cloud handles posture and workload protection, not cross-source correlation.

Quick Rules

Know these cold

  • ▸ 4624 success, 4625 failure, 4672 admin privileges, 4688 process created, 4740 lockout, 1102 log cleared
  • ▸ Logon type 2 interactive, 3 network (shares), 10 RemoteInteractive (RDP)
  • ▸ Syslog severity 0 emergency to 7 debug; UDP 514 plaintext and lossy, TLS on TCP 6514
  • ▸ Tier 1 triages and escalates, tier 2 scopes and contains, tier 3 hunts proactively
  • ▸ Priority = severity plus asset criticality — medium on a domain controller beats high on test
  • ▸ Pyramid of Pain — ashes at the base, IPs and domains above, TTPs hardest to change
  • ▸ Sigma searches SIEM log events; YARA matches file or memory content; condition decides matches
  • ▸ Hunting starts without an alert; investigating a fired alert is triage, not a hunt
  • ▸ AWS — loudTrail who did it, Flow Logs who talked, GuardDuty detects, Security Hub aggregates
  • ▸ Containment before eradication; restore only from verified clean backups after closing the entry point
Self Check

Can you answer these without checking your notes?

In this scenario: "A credential-phishing email reached 240 mailboxes; three users clicked and one entered credentials" — what should you do first?
Purge the message organization-wide and block the URL, then for the user who submitted credentials revoke sessions and tokens, reset the password and check for malicious forwarding or hiding inbox rules.
In this scenario: "Attackers stayed undetected for about 40 days, but containment after detection took under two hours" — what should you do first?
Dwell time before detection is MTTD, which reflects visibility and detection coverage. MTTR starts only after detection and is already good here, so the fix is new log sources, use cases and hunting.
In this scenario: "A file server shows a six-hour gap in its Security log; the SIEM copy shows event 1102" — what should you do first?
1102 means the Security audit log was cleared, a classic anti-forensics step, here under a domain admin account. Treat it as an incident, trust the forwarded copy and investigate that account's activity.
Failure Patterns

Common Exam Mistakes — What candidates get wrong

Disabling a noisy SIEM rule instead of tuning it

If a nightly authenticated vulnerability scan from a fixed IP trips a 20-failed-logons-per-minute rule, add an exclusion for that source. Turning the rule off creates a false negative gap, the most dangerous triage outcome.

Calling a correlation rule an aggregation, or normalization a storage saving

Normalization maps vendor fields to a common schema so events compare. Aggregation collapses identical events into one record with a count. Correlation links different events across sources or time into a meaningful alert.

Reimaging or powering off a compromised host as the first move

Both destroy memory evidence and skip scoping other victims. With EDR deployed, network-isolate the host; it stays reachable from the console while volatile data and disk are preserved for investigation.

Swapping STIX and TAXII, or tactical and technical intelligence

STIX is the content format, TAXII the transport, MISP-style platforms manage both. A hash or IP list is technical intelligence and ages quickly; tactical intelligence describes adversary TTPs; a board briefing on actor groups is strategic.

Labelling many failures spread over many accounts as brute force

600 failures across 300 accounts at two attempts each is password spraying, built to stay under lockout thresholds. Brute force hammers a single account. Name the specific technique; the exam rarely accepts the broad category.

Continue your prep

Resources to help you pass EC-Council Certified SOC Analyst on your first attempt

Practice Questions

Strengthen weak areas with exam-style practice questions and detailed explanations.

Mock Exam

Simulate the real exam experience and assess your readiness under timed conditions.

Study Guide

Review key concepts, objectives, and exam topics in one place.

AI Tutor

Get personalized explanations, learning recommendations, and instant answers.

EC-Council CSA Training

Follow a structured learning path designed to help you prepare efficiently.

EC-Council CSA rewards picking the right next step from an alert or log line. Test yours.

Start Diagnostic Test → View all exams
Other cybersecurity Cheat Sheet