Free TryHackMe SAL1 Exam Prep
TryHackMe Security Analyst Level 1 (SAL1)
Prepare for the TryHackMe SAL1 exam without spending hundreds on expensive prep courses. Free study guides, practice questions, flashcards, and related exam resources.
Quick Facts
Explore More TryHackMe Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
TryHackMe TryHackMe Certifications License: Complete Roadmap
Follow this path to organize your licensing and exam preparation
Phase 1: SOC Foundations & Alert TriageYou are here
Master alert classification, triage workflow, SOC tiers, workbooks, and SOAR concepts.
Phase 2: SIEM & Log Analysis
Practice Splunk SPL queries, Windows Event IDs, Sysmon, and Elastic Stack fundamentals.
Phase 3: Phishing, Network, & Threat Intel
Drill email header analysis, SPF/DKIM/DMARC, network traffic patterns, Pyramid of Pain, and MITRE ATT&CK.
Phase 4: SOC Simulator Practice
Complete TryHackMe's SOC simulator rooms and practice writing case reports under timed conditions.
Can You Take the TryHackMe SAL1 Exam?
Check if you meet the basic eligibility requirements
- •Stable internet connection required for the 24-hour exam window
- •Browser-based exam environment — no special software installation required
- •Candidates should be comfortable using Splunk, Wireshark, and email analysis tools
TryHackMe SAL1 Quick Facts
Time to Get Licensed
6-10 weeks for candidates who are new to SOC operations; 2-4 weeks for those with prior security monitoring experience
From start to license in hand
Retake Policy
Check TryHackMe's official certification page for current retake policy and waiting period requirements.
Total Cost Breakdown
Free TryHackMe SAL1 Prep Tools
Reported exam pass rate: TryHackMe does not publish official SAL1 pass rate statistics.. These figures describe exam candidates, not OpenExamPrep user outcomes. Check the exam sponsor’s website for published statistics.
100 Practice Questions
100 MCQ covering all SAL1 domains: alert triage, SIEM, phishing, network analysis, and MITRE ATT&CK.
AI-Powered Learning
Get personalized guidance on weak SOC analyst skill areas before your exam day.
2026 Updated
Review the current TryHackMe SOC Level 1 path and SAL1 exam format.
Free Access
Practice SAL1-style questions free with detailed explanations grounded in real SOC workflows.
What You'll Study
15 chapters covering the exam topics in this guide
Introduction & Exam Overview
4 sections
SOC Simulator Exam Skills
3 sections
Network Essentials
2 sections
Operating System Basics
2 sections
Cryptography, Cloud, Web and Scripting Basics
3 sections
Cybersecurity Fundamentals and MITRE ATT&CK
3 sections
Kill Chain, NIST CSF, and Attack Indicators
3 sections
Social Engineering and Network Attacks
4 sections
Web Exploitation and Endpoint Attacks
4 sections
Command and Control, Malware, and LOLBAS
2 sections
EDR, Firewalls, and WAF
3 sections
SIEM and SOAR
3 sections
Threat Intelligence and Vulnerability Scanning
3 sections
SOC Team, Activities, and Alert Triage
4 sections
SOC Metrics, Escalation, and Communication
2 sections
TryHackMe SAL1 Exam Details
TryHackMe Security Analyst Level 1 (SAL1)
Administered by TryHackMe
Exam Content Breakdown
Based on the official TryHackMe content outline
Alert classification (True Positive, False Positive, Benign TP), enrichment workflow, escalation criteria, SOC tiers, workbooks, runbooks, SOC metrics (MTTD, MTTR, MTTA), SOAR automation.
Splunk SPL queries (stats, dedup, timechart, lookup tables), Elastic Stack architecture (ELK), Windows Event IDs (4624, 4625, 4688, 4720, 4728, 7045), Sysmon events, log correlation.
Email header analysis (Received, From, Reply-To, Message-ID, Authentication-Results), SPF/DKIM/DMARC, typosquatting, sender spoofing, double extension masquerading, URL parsing.
OSI model, TCP three-way handshake, port scanning (SYN scan), beaconing, fast-flux DNS, DGA, ARP spoofing, HTTP status codes, SSL/TLS, Wireshark display filters.
MITRE ATT&CK (tactics, techniques, sub-techniques), Pyramid of Pain, Cyber Kill Chain, Unified Kill Chain, IoC vs IoA, VirusTotal, AbuseIPDB, MISP, threat intelligence lifecycle.
Process tree analysis, PowerShell obfuscation, web shell detection, directory traversal, credential dumping (Mimikatz), Active Directory attacks, ransomware containment, incident reporting.
What's Included
15 Chapters
Complete exam coverage
Practice Quizzes
With detailed explanations
Free to Start
No credit card required
Quality Exam Prep Shouldn't Cost Hundreds
I'm Ran Chen, an engineer with 20+ years of coding experience. I passed my Life Insurance license, EA exam, SIE, Series 6, 63, 65, and finally the CFP® exam.
Through all these exams, one thing became clear: exam prep is expensive. But with AI, we can change that. Quality preparation can now be free for everyone.
What's Next After the TryHackMe SAL1?
After passing the TryHackMe SAL1, you can pursue these career paths
TryHackMe SAL1 Exam FAQ
Official TryHackMe Resources
Verify information with these official sources
More Free Resources
Ready to Start Your Free TryHackMe SAL1 Prep?
Review the study guide, practice key concepts, and use the free tools at your own pace.