Do you guarantee that I will pass?
No. Certification is earned based on individual performance. We do not guarantee exam results or successful outcomes.
About the Certification
kSOCA is a foundation-level certification that validates core Security Operations Center skills. Candidates must demonstrate the ability to investigate security events, analyze logs, identify suspicious activity, correlate evidence, and communicate findings clearly in a practical blue-team environment.
What is this exam?
kSOCA is a practical, foundation-level exam that evaluates how effectively a candidate can investigate a security incident in a SOC-style environment. Candidates are assessed on their ability to work with log data, follow investigative leads, identify suspicious activity, and reconstruct key events from the available evidence.
Who should take this exam?
kSOCA is ideal for beginners who want to build real, hands-on SOC investigation and log analysis skills in a structured and practical way. It is well suited for security students, aspiring SOC analysts, blue team beginners, IT or support professionals, incident response learners, and anyone exploring cybersecurity operations as a career path.
Exam format
The exam is conducted in a controlled environment and provides a scenario-based SOC investigation lab. Candidates must perform an actual investigation using the provided evidence and log data, identify key details from the incident, and submit the correct flags as proof for each task.
All tasks are practical and require candidates to search, filter, correlate, and analyze security events to uncover important information such as suspicious activity, attacker behavior, indicators, and timeline details.
The assessment is 1.5 hours in duration, with an additional 30 minutes allocated for environment preparation, including instance creation and lab setup. The total allotted time for the exam is 2 hours.
Experience needed
This is a practical, hands-on exam, so candidates should have some basic experience with SOC investigation and log analysis before attempting it. You should understand how to review security events, work with timestamps, identify suspicious activity, and follow evidence across logs.
A minimum level of investigation experience is needed, including familiarity with basic phishing indicators, authentication activity, IP addresses, URLs, user agents, and simple Splunk searches.
Pass criteria
- Candidates must achieve a minimum overall score of 75% to pass the exam and receive their certification credentials.
- Candidates achieving an overall score of 85% or above will be awarded a Merit distinction.
Policies
All exams are conducted under strict integrity standards. Candidates must complete the exam independently—receiving or providing help, using unauthorized resources, or sharing questions or answers in any form (during or after the exam) is strictly prohibited and may result in disqualification and revocation of certification.
Retake policy
This exam includes 1 free retake as part of the voucher policy. After all included retakes are used, any additional attempt will require the purchase of a new voucher.
Certificate validity
This certification includes lifetime online verification and does not expire. Each certificate clearly indicates the exam version and the exam passing date to provide transparent context on when the assessment was completed.
As industry practices and tools evolve, we strongly recommend taking the latest exam version periodically to demonstrate that your knowledge and skills remain current.
Exam Syllabus
- Understand common phishing and spoofing techniques
- Analyze email metadata and headers
- Identify suspicious sender infrastructure
- Recognize indicators of social engineering attempts
- Correlate email-based threats with endpoint activity
- Understand Windows security event logging
- Analyze authentication and access events
- Identify abnormal user activity
- Build timelines from event log data
- Correlate logs across users, hosts, and services
- Analyze suspicious host activity
- Identify abnormal process execution
- Understand script-based malware behavior
- Review endpoint artifacts related to compromise
- Correlate endpoint behavior with user activity
- Analyze outbound and internal network connections
- Identify suspicious communication patterns
- Understand attacker command-and-control behavior
- Review traffic logs for unusual data movement
- Correlate network activity with host-based evidence
- Search and filter security logs using Splunk
- Use field extraction and time-based queries
- Correlate events across multiple data sources
- Identify relevant indicators from indexed logs
- Validate findings using structured search results
- Understand Windows domain account activity
- Analyze privilege-related security events
- Identify suspicious group and permission changes
- Recognize signs of account misuse
- Understand attacker persistence techniques
- Reconstruct attack timelines from multiple artifacts
- Connect email, endpoint, authentication, and network evidence
- Validate findings using timestamps and log sources
FAQ
Are exam fees refundable?
All exam purchases are final. Once purchased, no refunds will be issued under any circumstances.
If I fail, when can I retake the exam?
You can retake the exam immediately after a failed attempt or at any time before your exam voucher expires. There is no mandatory waiting period between attempts, as long as your voucher remains valid.
Can I share my exam content or answers?
No. Sharing exam questions, answers, or any part of the assessment is strictly prohibited and may result in disqualification or revocation of certification.