Certified SOC Analyst (CSA)

Last checked October 22, 2026 against the official EC-Council exam page.

1. Question 1Incident Detection and Triage

   What is a false positive in alert triage?

   1. AA real attack that the detection rules failed to raise an alert for when it occurred on the network
   2. BAn alert that was raised for activity that turns out to be benign after the analyst has reviewed it
   3. CA duplicate ticket that was created in the ticketing system for an alert that was already being handled
   4. DAn alert that carries a low severity label in the tool, even though it may refer to important activity
   Show answer and explanationHide answer

   Correct answer: B

   A false positive is an alert on benign activity, which adds noise to the queue. A missed real attack is a false negative, while duplicate tickets and low severity labels are workflow and classification issues.

2. Question 2Security Operations and Management

   What is the main purpose of a SOC maturity model?

   1. ATo describe how capable a SOC is across people, process, and technology so that improvements can be planned
   2. BTo set the salary bands for analysts across every team in the company so that pay stays consistent
   3. CTo count the number of alerts closed each day as the only measure of how well the SOC is performing
   4. DTo replace the incident response plan with a checklist that analysts follow during every security event
   Show answer and explanationHide answer

   Correct answer: A

   A maturity model gives a structured view of the SOC's people, processes, and technology, which is the basis for a roadmap of improvements. Pay bands, a single activity count, and replacing the incident response plan each misunderstand what maturity assessment is for.

3. Question 3Understanding Cyber Threats, IoCs, and Attack Methodology

   Which attack type injects malicious SQL through an application input field?

   1. ASQL injection, which places attacker-supplied SQL into a query the application builds from input
   2. BDenial of service, which overwhelms a service with traffic so that legitimate users cannot reach it
   3. CCross-site scripting, which injects script that runs in the browser of other users of the site
   4. DSession hijacking, which steals a valid session token so that the attacker can act as the logged-in user
   Show answer and explanationHide answer

   Correct answer: A

   SQL injection places attacker-controlled SQL into a query built from unvalidated input, which is the behaviour described. Cross-site scripting, denial of service, and session hijacking are distinct attack types that do not inject SQL into a database query.

4. Question 4Log Management

   Which Windows Security log event shows that an account successfully logged on?

   1. AEntries in the Setup log that record the installation of an update package on the machine
   2. BEvent entries in the System log about driver updates that were installed on the host
   3. CEntries in the Application log for the printer spooler service that handled the print jobs
   4. DEvent ID 4624, which records that an account was successfully logged on to the system
   Show answer and explanationHide answer

   Correct answer: D

   Event ID 4624 in the Security log records a successful logon, which is central to tracing account use. Driver, spooler, and setup logs record other activity on the host.

5. Question 5Proactive Threat Detection

   Which type of threat intelligence describes the tactics, techniques, and procedures used by threat actors?

   1. AStrategic reports that describe the budget priorities of the organization for the coming financial year
   2. BVulnerability scanner results that list the weaknesses found on the assets during the latest scan cycle
   3. CTactical intelligence on TTPs, which describes how threat actors operate so that defenders can detect them
   4. DAsset inventory data that records the hardware and the software installed on each endpoint in the estate
   Show answer and explanationHide answer

   Correct answer: C

   Tactical intelligence describes how adversaries operate, which is what defenders need to build detections. Strategic reports, scan results, and asset inventories provide other kinds of information that do not describe adversary behaviour.