100+ Free OSDA Practice Questions
Pass your OffSec Defense Analyst (OSDA) exam on the first try — instant access, no signup required.
A Windows security log entry with Event ID 4624 indicates which event?
Key Facts: OSDA Exam
24 hrs
Exam Duration
OffSec (23h45m practical)
75/100
Passing Score
OffSec
10
Phases
OffSec (10 pts each)
$2,499
Learn One Price
OffSec annual
3 yrs
Validity
OffSec (since 2023)
200-level
Difficulty
OffSec foundational SOC
The OSDA exam is NOT multiple choice — it is a 23h45m hands-on detection lab with 10 phases (10 points each, 75 to pass) using pre-recorded attack logs in an Elastic SIEM, plus 24 hours for the report. You detect, document, and map attacker actions to MITRE ATT&CK. Our 100 practice questions on this site build the underlying knowledge (Event IDs, Sysmon, ATT&CK mapping, hunting queries) — they do NOT replicate the exam. Certification is valid 3 years.
Sample OSDA Practice Questions
Try these sample questions to test your OSDA exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1A Windows security log entry with Event ID 4624 indicates which event?
2Which Sysmon event ID corresponds to 'Process Create' and is central to execution-tactic detection?
3Which MITRE ATT&CK tactic is associated with technique T1059 Command and Scripting Interpreter (e.g., PowerShell)?
4Which Windows Event ID shows that a Windows event log was cleared — a common Defense Evasion indicator?
5Which PowerShell logging event ID captures the actual script block content executed (including deobfuscated content)?
6Which Windows Event ID indicates a new service was installed — often used for T1543.003 Persistence: Windows Service?
7Which Kibana/Elastic query language does the current OSDA-era SOC-200 primarily use?
8Which Sysmon event ID logs a network connection from a process?
9Which ATT&CK technique is reflected by PowerShell using `Get-WmiObject Win32_Process` to enumerate remote hosts?
10Which Windows Event ID captures special-privilege (admin) tokens assigned to a session at logon — often a precursor to Privilege Escalation detection?
About the OSDA Exam
The OffSec Defense Analyst (OSDA) is OffSec's blue-team certification tied to the SOC-200 course. It validates the ability to detect, triage, and investigate attacker activity across the full MITRE ATT&CK kill chain using a SIEM (Elastic/Kibana), Windows event logs, Sysmon, PowerShell logging, and forensic artifacts.
Questions
10 scored questions
Time Limit
23 hours 45 minutes + 24 hours reporting
Passing Score
75/100 points (10 phases x 10 pts)
Exam Fee
$2,499 (Learn One annual subscription) (OffSec (Offensive Security))
OSDA Exam Content Outline
SIEM & Log Analysis (Elastic/Kibana)
KQL/Lucene queries, Sigma rules, dashboard creation, log source integration, Windows Event Log (4624/4625/4688/4672/7045/1102), Sysmon events 1/3/7/11/13/22
MITRE ATT&CK Framework
Mapping attacker actions to tactics/techniques: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, C2, Exfiltration, Impact
Detection Engineering
PowerShell logging (ScriptBlock 4104, Transcription), ETW, process injection detection, lateral movement patterns (WMI/PSExec/WinRM/RDP), persistence (Run keys, services, scheduled tasks), C2 beaconing analysis
Forensic Triage & Incident Response
Artifact analysis (prefetch, amcache, shimcache, UserAssist, Jump Lists), memory analysis (Volatility), network forensics (PCAP in Wireshark), IR playbooks, KAPE/Velociraptor
How to Pass the OSDA Exam
What You Need to Know
- Passing score: 75/100 points (10 phases x 10 pts)
- Exam length: 10 questions
- Time limit: 23 hours 45 minutes + 24 hours reporting
- Exam fee: $2,499 (Learn One annual subscription)
Keys to Passing
- Complete 500+ practice questions
- Score 80%+ consistently before scheduling
- Focus on highest-weighted sections
- Use our AI tutor for tough concepts
OSDA Study Tips from Top Performers
Frequently Asked Questions
Is the OSDA exam multiple choice?
No. The OSDA exam is a 23h45m hands-on SOC-analyst simulation. You work through pre-recorded logs in an Elastic SIEM (since the Sep 10, 2024 format update) across 10 phases. Each phase contains multiple attacker actions you must detect, document, and map to MITRE ATT&CK. Then you have 24 hours to submit a professional incident report. Our 100 practice questions build the knowledge (Event IDs, Sysmon, KQL, ATT&CK) — they do not replicate the exam.
What is the OSDA passing score?
You need 75 out of 100 points. The exam is split into 10 phases worth 10 points each. Each phase contains a number of attacker actions (enumeration, brute force, lateral movement, privilege escalation, persistence, etc.) that must be detected and documented to earn points.
Which SIEM does the OSDA use?
The current SOC-200 course and OSDA exam use an Elastic Stack (Elasticsearch + Kibana) deployment with Windows Event Log and Sysmon data. While the concepts of SIEM analysis apply broadly (Splunk, Sentinel, etc.), hands-on lab work is done in Elastic/Kibana, so KQL/Lucene query syntax matters.
What Windows Event IDs do I need to know for OSDA?
Core IDs: 4624 (logon), 4625 (failed logon), 4672 (special privileges), 4688 (process creation), 4697/7045 (service install), 1102 (log clear), 5140 (file share access), 4103/4104 (PowerShell ScriptBlock/Module logging). Sysmon: 1 (process), 3 (network connect), 7 (image load), 11 (file create), 13 (registry value set), 22 (DNS query). Our practice questions drill all of these.
Is OSDA entry-level?
OSDA is SOC-200-level — foundational in the OffSec SOC track. It assumes general IT knowledge and basic security concepts but does not require prior certifications. Community estimates put first-attempt pass rates in the 60-70% range for candidates who complete the SOC-200 labs.
How should I use these practice questions?
Treat them as knowledge validators for SOC-200 modules. Weak answers on Event ID meanings, Sysmon schema, KQL syntax, or ATT&CK technique mapping point you back to the course labs and the ATT&CK Navigator. The real exam rewards speed of pivoting through logs — knowledge is a prerequisite for that speed.