All Practice Exams

100+ Free HTB CDSA Practice Questions

Prepare for the HTB Certified Defensive Security Analyst exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
Not published Pass Rate
100+ Questions
100% Free

Loading practice questions...

2026 Statistics

Key Facts: HTB CDSA Exam

7 days

Practical Exam Window

Hack The Box

15 modules

SOC Analyst Path

HTB Academy

~$210

Exam Voucher

Hack The Box

Intermediate

Difficulty Level

Hack The Box

150-250 hrs

Avg. Study Time

Community estimate

2 incidents

Exam Scenarios

CDSA review reports

The HTB CDSA (Certified Defensive Security Analyst) certifies intermediate SOC analyst skills through a 7-day practical lab and incident report. Domains include SIEM operations (Elastic/Splunk), network traffic analysis (Wireshark/tcpdump), Windows event log analysis, YARA and Sigma rule writing, threat hunting, Windows/AD attack detection, and incident reporting. The exam voucher costs ~$210 or is included in an HTB Academy Silver subscription (~$490/year). This 100-question practice exam covers the knowledge domains of the 15-module HTB SOC Analyst path.

Sample HTB CDSA Practice Questions

Try these sample questions to test your HTB CDSA exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1In the NIST incident handling lifecycle, which phase immediately follows the Detection and Analysis phase?
A.Containment, Eradication, and Recovery
B.Preparation
C.Post-Incident Activity
D.Identification
Explanation: The NIST SP 800-61 incident response lifecycle has four main phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. After detecting and analyzing an incident, the team moves to contain the threat, eradicate its root cause, and recover normal operations.
2A SOC analyst sees 50 failed Windows logon events (Event ID 4625) in 10 minutes from a single source IP targeting one account. Which attack type does this most likely indicate?
A.Password spraying
B.Credential stuffing
C.Brute force attack
D.Pass-the-hash
Explanation: A high volume of failed logons (Event ID 4625) against a single account from one source IP in a short timeframe is the classic signature of a brute force attack. Password spraying targets many accounts with few guesses; credential stuffing replays breached credential pairs; pass-the-hash uses NTLM hashes and does not produce many 4625 events.
3Which Sysmon Event ID records the creation of a new process and is most useful for detecting execution of malicious binaries?
A.Sysmon Event ID 1
B.Sysmon Event ID 3
C.Sysmon Event ID 8
D.Sysmon Event ID 11
Explanation: Sysmon Event ID 1 (Process Creation) logs every new process with its full command line, parent process, hashes, and user context. This makes it invaluable for detecting malicious binary execution. Event ID 3 is network connection; Event ID 8 is CreateRemoteThread; Event ID 11 is file creation.
4In Elastic/KQL, which query correctly searches for all Windows Security events with Event ID 4688 (process creation)?
A.event.code:4688 AND winlog.channel:Security
B.SELECT * FROM Security WHERE EventID=4688
C.index=windows EventCode=4688
D.event_id=4688 source=WinEventLog:Security
Explanation: In Kibana Query Language (KQL) used with the Elastic Stack, field:value syntax is used. `event.code:4688` filters for that specific Windows event ID and `winlog.channel:Security` scopes it to the Security event log. The SQL-style query is not KQL. The other two are Splunk SPL syntax.
5A Wireshark capture shows repeated TCP SYN packets sent to ports 21, 22, 23, 25, 80, and 443 on a target host with no SYN-ACK responses. What does this traffic pattern indicate?
A.A TCP SYN port scan
B.A successful TCP handshake negotiation
C.An ARP spoofing attack
D.A UDP flood denial of service
Explanation: Sequential SYN packets to multiple ports with no SYN-ACK replies is the hallmark of a TCP SYN scan (half-open scan). The scanner sends SYN packets to identify open ports; closed ports respond with RST, and filtered ports do not respond. No RST or SYN-ACK means the ports are filtered or the host is down.
6In Splunk SPL, which search correctly identifies authentication failures for the Windows Security log?
A.index=windows EventCode=4625 | stats count by user
B.index=windows EventCode=4624 | stats count by user
C.sourcetype=WinEventLog:System EventID=4625
D.event.code:4625 AND winlog.channel:Security
Explanation: Windows Event ID 4625 is 'An account failed to log on.' In Splunk SPL, `index=windows EventCode=4625` targets the correct event, and `| stats count by user` aggregates failed attempts per account. EventCode 4624 is successful logon. The last option is KQL, not SPL.
7Which MITRE ATT&CK tactic describes actions taken by an adversary to maintain access to a compromised system across restarts?
A.Defense Evasion
B.Lateral Movement
C.Persistence
D.Privilege Escalation
Explanation: Persistence (TA0003) in MITRE ATT&CK covers techniques adversaries use to keep access to systems across interruptions such as restarts, changed credentials, or other disruptions. Examples include registry run keys, scheduled tasks, and new service creation. Defense Evasion focuses on avoiding detection; Lateral Movement on pivoting across the network.
8A YARA rule contains the condition `all of them`. What does this mean?
A.Match files that contain all of the defined strings
B.Match files that contain at least one of the defined strings
C.Match all files regardless of content
D.Match files where the file size exceeds a threshold
Explanation: `all of them` in YARA requires every defined string (or pattern) in the rule to be present in the scanned file for the rule to match. `any of them` would require at least one string. YARA conditions like `filesize` are separate keywords for size-based matching.
9In a Sigma rule, which field specifies the log source category (e.g., process_creation)?
A.logsource
B.detection
C.condition
D.title
Explanation: The `logsource` block in a Sigma rule defines where the log data comes from, including `category` (e.g., process_creation, network_connection), `product` (e.g., windows), and `service` (e.g., sysmon). The `detection` block contains search identifiers and conditions; `condition` is inside detection.
10Windows Event ID 4624 logon type 3 indicates which type of authentication?
A.Network logon (SMB, file share, or similar)
B.Interactive (local) logon at the console
C.Remote Desktop Protocol logon
D.Batch logon from a scheduled task
Explanation: Logon Type 3 in Event ID 4624 represents a network logon, which occurs when a user or service authenticates over the network such as via SMB, file shares, or `net use`. Type 2 is interactive; Type 10 is RemoteInteractive (RDP); Type 4 is batch.

About the HTB CDSA Exam

The HTB Certified Defensive Security Analyst (CDSA) is a hands-on SOC-focused certification by Hack The Box. Candidates spend 7 days working through a realistic SOC lab environment covering two incidents, then submit a professional incident report graded by HTB staff. This practice exam prepares candidates by testing knowledge of Elastic, Splunk, Wireshark, Windows event logs, YARA, Sigma, MITRE ATT&CK, and incident handling.

Assessment

Performance-based assessment

Time Limit

7 days (lab) + incident report

Passing Score

Not published

Exam Fee

~$210 voucher (Hack The Box)

HTB CDSA Exam Content Outline

35%

Security Analysis & SIEM Operations

Elastic KQL/EQL, Splunk SPL, Winlogbeat/Filebeat, detection rules, alert triage, and Kibana threat hunting workflows

25%

Windows Event Logs & Endpoint Detection

Critical Windows Security and System Event IDs, Sysmon event types, PowerShell logging, and detecting credential theft, persistence, and lateral movement

20%

Network Traffic Analysis & IDS

Wireshark display filters, tcpdump BPF syntax, Snort/Suricata rules, protocol analysis, C2 beaconing, DNS tunneling, and ARP attacks

10%

YARA & Sigma Detection Engineering

YARA rule structure (strings, conditions, PE module, imphash), Sigma rule structure (logsource, detection, modifiers, level), and sigmac conversion

10%

Incident Handling & Reporting

NIST SP 800-61 lifecycle, containment strategies, evidence collection, IOC documentation, and professional incident report writing

How to Pass the HTB CDSA Exam

What You Need to Know

  • Passing score: Not published
  • Assessment: Performance-based assessment
  • Time limit: 7 days (lab) + incident report
  • Exam fee: ~$210 voucher

Keys to Passing

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

HTB CDSA Study Tips from Top Performers

1Master Elastic KQL and Splunk SPL query syntax — the exam requires fluent SIEM investigation skills
2Know the critical Windows Security Event IDs (4624, 4625, 4688, 4720, 4728, 4771, 7045) and what each means for threat detection
3Practice Sysmon event types (Process Creation ID 1, Network Connection ID 3, DNS Query ID 22, CreateRemoteThread ID 8) for endpoint hunting
4Build YARA rules from scratch using strings, conditions, and the PE module to understand malware detection logic
5Write Sigma rules and use sigmac to convert them — understand how logsource, detection, and condition blocks work together
6Practice Wireshark analysis: Follow TCP Stream, use display filters, identify C2 beaconing, DNS tunneling, and port scan patterns
7Understand MITRE ATT&CK tactics and techniques — know the TTP IDs for common attacks like Kerberoasting (T1558.003) and LOLBins (T1140)
8Practice writing professional incident reports: executive summary, technical timeline, IOC appendix, and remediation recommendations
9Complete all HTB Academy lab exercises for each module — the exam tests applied skills, not just theory

Frequently Asked Questions

What is the HTB CDSA exam format?

The HTB CDSA is a 7-day practical exam in a browser-based SOC lab environment. Candidates analyze multiple real-world security incidents using SIEM platforms (Elastic and Splunk), network traffic analysis tools, and Windows event logs. After completing the lab, candidates must submit a professional-grade security incident report. Results take up to 20 business days and are evaluated by HTB staff.

What modules are in the HTB CDSA SOC Analyst path?

The 15-module path includes: Incident Handling Process; Security Monitoring & SIEM Fundamentals; Windows Event Logs & Finding Evil; Introduction to Threat Hunting & Hunting With Elastic; Understanding Log Sources & Investigating with Splunk; Windows Attacks & Defense; Intro & Intermediate Network Traffic Analysis; Working with IDS/IPS; YARA & Sigma for SOC Analysts; Detecting Windows Attacks with Splunk; JavaScript Deobfuscation; Introduction to Digital Forensics; Introduction to Malware Analysis; and Security Incident Reporting.

How much does the HTB CDSA cost?

The CDSA exam voucher costs approximately $210 USD when purchased standalone. An HTB Academy annual Silver subscription (~$490/year) includes one exam voucher for CDSA, CWES, or CPTS. This makes the Silver subscription economical if you plan to take any of the three HTB certification exams.

How hard is the HTB CDSA?

The CDSA is rated intermediate difficulty. It requires practical hands-on skills in SIEM analysis, Windows event log investigation, network traffic analysis, and incident report writing. Candidates who have completed all 15 modules of the SOC Analyst path and worked through the included labs are best positioned to pass. The 7-day window is generous, but the quality of the incident report is critical.

What jobs does HTB CDSA qualify me for?

HTB CDSA demonstrates practical SOC analyst skills valued in: SOC Analyst Tier 1/2 ($55,000-$85,000), Security Analyst ($70,000-$110,000), Incident Responder ($80,000-$120,000), Threat Hunter ($90,000-$130,000), and Detection Engineer ($95,000-$140,000) roles. It complements vendor certifications (Splunk Core Certified User, Elastic Certified Analyst) and broad certs (CompTIA Security+).

Is this practice exam like the real HTB CDSA?

No — this is a knowledge-based multiple-choice practice exam. The real CDSA is a hands-on practical lab where you analyze actual security incidents in a live environment and write a professional report. This practice exam tests the theoretical knowledge and tool concepts from the 15-module SOC Analyst path. To pass the real exam, you need extensive lab practice with Elastic, Splunk, Wireshark, and Windows event log analysis.