EC-Council CSA study guide · 2026

The 8 EC-Council CSA domains, explained

8 domains and 59 official objectives. Incident Detection and Triage carries the most weight at 25%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 4 See all domains
Questions
100
Time
3 hours
Passing score
70%
Outline
Certified SOC Analyst (CSA) v2 Exam Blueprint, exam 312-39 (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 5%
  2. 2 8%
  3. 3 15%
  4. 4 25%
  5. 5 12%
  6. 6 25%
  7. 7 5%
  8. 8 5%
  1. 1 Security Operations and Management
  2. 2 Understanding Cyber Threats, IoCs, and Attack Methodology
  3. 3 Log Management
  4. 4 Incident Detection and Triage
  5. 5 Proactive Threat Detection
  6. 6 Incident Response
  7. 7 Forensics Investigation and Malware Analysis
  8. 8 Introduction to Cloud SOC

All 8 domains

59 official objectives 70–98 hrs suggested study

  1. Domain 01 5%

    Security Operations and Management

    The opening CSA v2 domain, worth 5%. It explains why a Security Operations Center exists, how alerts move through its workflow and analyst tiers, how sourcing models compare, and which maturity levels and metrics show whether the SOC is working.

    Inside this domain

    • Understand the principles of security management and identify the role of security operations in effective security management
    • Discuss Security Operations Center (SOC) and analyze its importance, capabilities, and functions
    • Describe the SOC workflow flow and identify the People, Process and Technology involved in SOC
    • Compare different SOC models and their respective advantages and disadvantages
    • and 2 more objectives

    Watch for Outsource everything

    Objectives
    6
    Questions est.
    ~5
    Study time est.
    4–6 hrs
  2. Domain 02 8%

    Understanding Cyber Threats, IoCs, and Attack Methodology

    Worth 8% of CSA v2, this domain teaches the attacks a SOC analyst must recognize: network, host, application, social engineering, email and insider TTPs, the indicators each leaves behind, and the frameworks used to describe attacker behavior.

    Inside this domain

    • Understand Cyber threats and its impact on Cyber Security
    • Understand Network Attack Tactics, Techniques, and Procedures (TTPs)
    • Understand Host Attack Tactics, Techniques, and Procedures (TTPs)
    • Understand Application Attack Tactics, techniques, and Procedures (TTPs)
    • and 5 more objectives

    Watch for Hash blocks the attacker

    Objectives
    9
    Questions est.
    ~8
    Study time est.
    6–9 hrs
  3. Domain 03 15%

    Log Management

    Log Management is 15% of CSA v2. It covers why logs matter and how they are managed, the local logs produced by operating systems, network devices, web servers, databases and mail systems, and how centralized logging collects them for analysis.

    Inside this domain

    • Understand Log Management its importance and approaches
    • Understand and Analyze Local Logging Practices: Windows, Linux and Mac Logs
    • Understand and Analyze Local Logging Practices: Firewall and Router Logs
    • Understand and Analyze Local Logging Practices: Web Server, Database, Email
    • and 1 more objectives

    Watch for Status 200 means blocked

    Objectives
    5
    Questions est.
    ~15
    Study time est.
    10–14 hrs
  4. Domain 04 25%

    Incident Detection and Triage

    Tied for the largest CSA v2 domain at 25%. It covers SIEM architecture, solution types and deployment, use case management and detection, using AI to draft SIEM rules, triaging alerts, and the dashboards and reports a SOC produces.

    Inside this domain

    • Understand the Importance and Architecture of Security Information and Event Management (SIEM)
    • Understand Types of SIEM Solutions and their advantages and Disadvantages
    • Understand Deploying a SIEM solution
    • Understand SIEM Use case Management
    • and 5 more objectives

    Watch for Fewer alerts means safer

    Objectives
    9
    Questions est.
    ~25
    Study time est.
    16–22 hrs
  5. Domain 05 12%

    Proactive Threat Detection

    Proactive Threat Detection is 12% of CSA v2. It combines cyber threat intelligence, covering types, strategies, sources, platforms and use in incident response, with threat hunting frameworks and hands-on hunting using PowerShell, YARA and dedicated tools.

    Inside this domain

    • Learn Fundamental Concepts of Threat Intelligence
    • Understand Types and Strategies of Threat Intelligence
    • Understand the Various Threat Intelligence Sources
    • Understand Threat Intelligence Platforms (TIP)
    • and 5 more objectives

    Watch for Data is intelligence

    Objectives
    9
    Questions est.
    ~12
    Study time est.
    9–12 hrs
  6. Domain 06 25%

    Incident Response

    Incident Response shares top weight in CSA v2 at 25%. It covers the incident response process and phases, handling network, application, email, insider and malware incidents, the role of SOC playbooks, and enhanced response using EDR and XDR.

    Inside this domain

    • Understand about Incident Response
    • Learn Various Phases in Incident Response Process
    • Learn to Respond to Network Security Incidents
    • Learn to Respond to Application Security Incidents
    • and 5 more objectives

    Watch for Reimage first

    Objectives
    9
    Questions est.
    ~25
    Study time est.
    16–22 hrs
  7. Domain 07 5%

    Forensics Investigation and Malware Analysis

    A 5% CSA v2 domain new in v2. It gives SOC analysts the investigation skills to support response: forensic principles, investigating network, application, email and insider incidents, and static and dynamic malware analysis.

    Inside this domain

    • Understand about Forensic Investigation
    • Investigating Network Security Incidents
    • Learn to Investigate Application Security Incidents
    • Learn to Investigate Email Security Incidents
    • and 4 more objectives

    Watch for Disk first

    Objectives
    8
    Questions est.
    ~5
    Study time est.
    5–7 hrs
  8. Domain 08 5%

    Introduction to Cloud SOC

    Introduction to Cloud SOC is 5% of CSA v2 and new in this version. It covers running a SOC for cloud environments and the security monitoring architecture and tools on Azure, AWS and Google Cloud.

    Inside this domain

    • SOC for Cloud Environments
    • Understand Azure SOC Architecture, Microsoft Sentinel and Security Tools
    • Understand AWS SOC Architecture, AWS Security Hub and security tools
    • Understand Google Cloud Platform (GCP) SOC Architecture, Security Command Center, Chronicle and security tools

    Watch for Flow logs show actions

    Objectives
    4
    Questions est.
    ~5
    Study time est.
    4–6 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 70–98 hrs of study.

  1. 4 Incident Detection and Triage 25% · 16–22 hrs
  2. 6 Incident Response 25% · 16–22 hrs
  3. 3 Log Management 15% · 10–14 hrs
  4. 5 Proactive Threat Detection 12% · 9–12 hrs
  5. 2 Understanding Cyber Threats, IoCs, and Attack Methodology 8% · 6–9 hrs
  6. 1 Security Operations and Management 5% · 4–6 hrs
  7. 7 Forensics Investigation and Malware Analysis 5% · 5–7 hrs
  8. 8 Introduction to Cloud SOC 5% · 4–6 hrs

Try one

Practice questionDomain 4: Incident Detection and Triage

A SIEM rule alerts on more than 20 failed logons per minute. Most alerts come from a vulnerability scanner that runs authenticated scans nightly from a fixed IP address. What should the SOC do to reduce noise while keeping coverage?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Outsource everything

    Clue Phrases like keep logs on premises or retain investigation internally.

  • Domain 2

    Hash blocks the attacker

    Clue The question asks which indicator causes the attacker the most difficulty.

  • Domain 3

    Status 200 means blocked

    Clue Response size is unusually large.

  • Domain 4

    Fewer alerts means safer

    Clue The scenario mentions a missing log source or unmonitored segment.

  • Domain 5

    Data is intelligence

    Clue The scenario lacks any assessment of relevance.

  • Domain 6

    Reimage first

    Clue Evidence or scope is still unknown.

  • Domain 7

    Disk first

    Clue The system is still running.

  • Domain 8

    Flow logs show actions

    Clue The question asks which identity made a change.

Other Cybersecurity certifications

Study guides for exams that overlap with EC-Council CSA.

Practise what you read

EC-Council CSA domains: common questions

How many domains are in the EC-Council CSA exam?

EC-Council CSA has 8 domains with 59 official objectives between them: Security Operations and Management, Understanding Cyber Threats, IoCs, and Attack Methodology, Log Management, Incident Detection and Triage, Proactive Threat Detection, Incident Response, Forensics Investigation and Malware Analysis and Introduction to Cloud SOC.

Which EC-Council CSA domain carries the most weight?

Incident Detection and Triage is the heaviest at 25%, followed by Incident Response (25%). The lightest is Introduction to Cloud SOC (5%). Weights come from EC-Council's official outline.

What is the EC-Council CSA exam format?

Questions: 100. Time allowed: 3 hours. Passing score: 70%.

How long should I study for EC-Council CSA?

Our planning estimate is 70–98 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Incident Detection and Triage, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows Certified SOC Analyst (CSA) v2 Exam Blueprint, exam 312-39 (current), published by EC-Council. It was last reviewed in October 2026.

Domain names, weights and objectives come from EC-Council's official outline (Certified SOC Analyst (CSA) v2 Exam Blueprint, exam 312-39 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.