1.1 Current SAL1 Exam Facts

What SAL1 Is

The TryHackMe Security Analyst Level 1 (SAL1) credential is an entry-level, hands-on security analyst certification. TryHackMe positions it for people who want Security Operations Center (SOC) analyst skills: students, career switchers, and practitioners with less than three years of experience. It is not a senior detection-engineering or red-team credential. It is a first professional cert that mixes a timed knowledge paper with live investigation work.

This OpenExamPrep chapter is independent study material covering SAL1 exam-operations topics: who the credential is for, how the three-part exam is built, how scoring and retakes work, and how to approach the multiple-choice section. Later chapters cover the five training domains TryHackMe lists for SAL1 — from networking and operating systems through SOC workflows — and the simulator skills that carry most of the marks. OpenExamPrep is not a TryHackMe partner, and this guide does not claim official approval or review.

A scored professional certification

Treat SAL1 as a professional certification, not as a learning-path completion certificate. Completing TryHackMe rooms can build skills the exam tests, but finishing a path does not award SAL1. You must start a scored exam, complete three sections inside a 24-hour window, and reach 750 out of 1000 marks. Path progress is practice. The exam is the credential.

TryHackMe’s “Is SAL1 right for me?” article (checked 2026-09-19) describes a highly competitive entry-level hiring funnel and presents SAL1 as a way to demonstrate job-ready analyst skills. Use that as motivation to take the hands-on sections seriously, not as a published employment guarantee. TryHackMe also does not publish an official SAL1 pass rate. Treat any blog percentage you see as unofficial unless TryHackMe itself posts the number.

Who Should Sit SAL1

If you can already triage alerts, write a case note, and explain why an event is a true positive versus a false positive, you are in the intended audience even if you have never held a SOC title. If you are still learning what a firewall log looks like, you can still sit SAL1, but you should expect the SOC Simulator (SOC Sim) scenarios — not the multiple-choice paper — to decide the result.

Typical fit:

• A student who wants a vendor-issued professional cert before applying to analyst internships or graduate SOC roles
• A career switcher from IT support, networking, or help desk who already sees tickets and logs
• An early-career analyst (under three years) who wants a structured, hands-on exam rather than a purely knowledge-based test

SAL1 is a poor fit if you need a specialist pentest or exploit-development credential; TryHackMe publishes other professional certifications for those paths. It is also a poor fit if you only want a badge for watching videos. The exam requires you to work alerts in a simulated SOC under time pressure, then document classification, escalation, and case-report work that TryHackMe scores separately.

Three Scored Parts in One Sitting

SAL1 is one exam with three sections. You do not book the multiple-choice paper on Monday and the labs on Friday. TryHackMe’s format article (23 Feb 2025) states that a 24-hour timer starts when you start the exam, that all three sections must be finished inside that window, and that sections must be completed in order.

The 1-hour and 2-hour figures are section limits. The 24-hour figure is the overall window. You cannot bank unused MCQ minutes into a simulator, and you cannot start scenario 2 before you finish scenario 1. Section 1.2 covers how the window, check-in, and delivery actually run.

Alert counts inside each simulator are variable. Do not memorise a fake “there will be 12 alerts” number. Plan for triage under time pressure with incomplete information.

How the 1000 Marks Are Weighted

The pass mark is 750 / 1000. That is 75% of the published total, but it is not “get 75% of the MCQ paper correct.” Marks are weighted:

• MCQ: 200 marks (20%)
• Two SOC Sims: 400 marks each (40% + 40% = 80%)

Because 800 of 1000 marks sit in the simulators, a strong knowledge paper cannot rescue two weak investigations. Arithmetic that matters on exam day:

• A zero on one entire simulator leaves at most 200 + 400 = 600 marks, which is below 750 even with a perfect remaining paper. You cannot pass if one simulator section is a complete blank.
• A zero on the MCQ still leaves 800 simulator marks. You would need 750 of those 800 (about 93.8% across the two sims combined). Possible in principle, but a harsh plan.
• A balanced pass might look like 140/200 on the MCQ and 305/400 on each sim (140 + 305 + 305 = 750). Many other combinations work. The point is that simulator performance dominates.

Each 400-mark simulator is itself split into Classification (150), Escalation (150), and Case Reports (100). Section 1.3 unpacks that split, retakes, and validity. Chapter 2 teaches how those three skills are judged inside the Analyst virtual machine.

What “hands-on” means here

“Hands-on” is not marketing filler. TryHackMe’s format article says the SOC Sim scenarios require analysing and responding to a variable number of alerts in a real-world SOC-style environment. You should expect to use investigation tools, make classification decisions, escalate when the case warrants it, and write case reports — not only pick letters on a quiz.

The MCQ still matters. It is 80 questions in 60 minutes covering SOC fundamentals, threat detection, incident response, and security concepts, with difficulty increasing as you progress (TryHackMe MCQ advice, 30 May 2025). Treat it as a fast knowledge gate, not as the main event. Section 1.4 is exam technique for that gate. It is not a dump of later domain content.

What This Guide Will and Will Not Do

This independent OpenExamPrep study guide will:

• Teach the logistics TryHackMe publishes (window, Onfido check-in, scoring, retakes, supported browsers)
• Teach the five training-domain topic groups and the simulator workflow in later chapters
• Give exam technique for the MCQ and for classification, escalation, and case reports

This guide will not:

• Publish a dollar price — check tryhackme.com for current pricing in your location
• Invent a pass rate
• Treat SAL1 as a completion certificate for a learning path
• Replace TryHackMe’s own candidate rules on exam day

When a Help Center article and an older access article disagree, this guide prefers the newest dated policy. Retake timing is the example you will see in section 1.3: the 20 July 2026 Retakes article supersedes the older “3 days after you started” wording.

Official Starting Points

Bookmark these before you pay or click Start:

• Purchase and overview page: tryhackme.com/certification/security-analyst-level-1
• Format and timings (23 Feb 2025): Exam Format and Timings
• Scoring (29 Mar 2025): Exam Scoring
• Audience: Is SAL1 right for me?

Read those pages yourself. Policies move. This chapter’s lastUpdated date is 2026-09-19; if TryHackMe changes a number after that, the Help Center wins.