1.3 Scoring, Retakes, Validity, and Access
Key Takeaways
- The SAL1 pass mark is 750 out of 1000, with 200 marks on the MCQ and 400 marks on each SOC Simulator scenario.
- Each simulator’s 400 marks split into Classification 150, Escalation 150, and Case Reports 100.
- Each purchase includes one free retake; the 20 July 2026 Retakes article says you can start a retake 48 hours after finishing the current attempt.
- Exam attempts are valid for 12 months from purchase; the certification is valid for 3 years from the date you start the exam.
- Professional certification purchases are non-refundable; check tryhackme.com for current prices and subscription discounts, and do not expect a published pass rate.
The Pass Mark and the Weighted Total
TryHackMe’s scoring article (29 Mar 2025) sets the pass mark at 750 out of 1000. Results include a detailed breakdown of scores per section, with feedback aimed at improvement rather than a single anonymous pass/fail bit.
The same article publishes the weightings:
- Multiple-choice questions (MCQ): 200 marks
- SOC Simulator challenges: 400 marks each
Each 400-mark simulator is broken down into:
- Classification: 150 marks
- Escalation: 150 marks
- Case Reports: 100 marks
That is the whole exam. There is no hidden fourth scored paper. There is no published official pass rate to compare yourself against — TryHackMe does not post one, so this guide will not invent a percentage.
| Component | Marks | Share of 1000 | What it is actually testing |
|---|---|---|---|
| MCQ paper | 200 | 20% | Breadth of SOC fundamentals and related concepts, 80 questions in 60 minutes |
| Sim 1 Classification | 150 | 15% | Verdict quality on alerts in scenario 1 |
| Sim 1 Escalation | 150 | 15% | Whether and how you escalate in scenario 1 |
| Sim 1 Case Reports | 100 | 10% | Written-up investigation quality in scenario 1 |
| Sim 2 Classification | 150 | 15% | Verdict quality on alerts in scenario 2 |
| Sim 2 Escalation | 150 | 15% | Whether and how you escalate in scenario 2 |
| Sim 2 Case Reports | 100 | 10% | Written-up investigation quality in scenario 2 |
Classification and escalation together are 300 of each simulator’s 400 marks. Case reports are the remaining 100. Candidates who “find the bad thing” but write nothing, or who write long notes but mis-classify, leave large, published buckets on the table. Chapter 2 teaches those three skills as exam technique. This section exists so you never study as if the MCQ were half the exam.
Weighted scoring, not a 75% MCQ myth
TryHackMe says the exam uses a weighted scoring method. The practical consequence for you is already in the table: 80% of the credential is simulator work. Getting 75% of the MCQ items right is 150 of 200, which is useful but nowhere near a pass by itself. Getting 75% of each simulator (300 of 400, twice) plus a modest MCQ score is a much more realistic path to 750.
Worked examples (illustrative combinations, not published grade boundaries inside a section):
- MCQ 160 + Sim1 300 + Sim2 300 = 760 — pass with room
- MCQ 200 + Sim1 400 + Sim2 140 = 740 — fail, because one weak simulator still sits under 750
- MCQ 100 + Sim1 330 + Sim2 330 = 760 — pass, which shows the knowledge paper is not a veto if both sims are strong
- MCQ 200 + Sim1 400 + Sim2 0 = 600 — fail, because a blank simulator cannot be rescued
Do not treat those rows as promises of how TryHackMe rounds an individual classification item. Treat them as budget math for study time: practice investigations first.
Retakes: Free Attempt, Timing, and Purchased Extras
The Retakes article dated 20 July 2026 is the newest retake-timing source. Prefer it when an older page disagrees.
Published retake rules:
- Each user is granted one free retake
- Beyond the free retake, additional retakes must be purchased
- There is no limit on how many times you can retake
- Retake options may still appear in your account after you pass; TryHackMe calls that normal
- Each attempt is independent — flags, challenges, and instance data are freshly generated
- You can only start a retake 48 hours (2 days) after finishing your current exam attempt
- Purchased retakes are valid for 12 months from the date of purchase
- Retakes follow the same format and rules as the original attempt
Why this guide prefers July 2026 over May 2025
The Certification Access article (19 May 2025) still describes a purchase as including two exam attempts and says you can retake 3 days after you started your first attempt. That is older wording, and it keys the wait to start time, not finish time.
The July 2026 Retakes article keys the wait to finishing the current attempt and sets it at 48 hours. If you finish a sitting on Wednesday evening, plan to become eligible Friday evening, not “three days after Wednesday’s start click.” If you ever see both sentences on TryHackMe properties, treat 48 hours after finishing as the rule this chapter teaches, and re-read the live Retakes article before you book the next sitting.
Do not burn the free retake as a discovery run. The 24-hour window plus two heavy simulators already give you a full professional attempt. Use section-level feedback from a fail to rebuild classification, escalation, and case-report habits before you spend the second attempt.
Passing, then retaking later
TryHackMe states that if you pass and then later fail, your passing status remains valid and you are still certified. The Help Center example is written with the PT1 exam, but it sits in the professional-certification Retakes article that covers this family of exams. Optional retakes for extra practice should not be treated as a way to accidentally shred a pass you already earned.
Validity Windows You Must Not Mix Up
| Clock | Length | When it starts | What it controls |
|---|---|---|---|
| Attempt validity | 12 months | Purchase date | How long you have to sit (and use included attempts) |
| Purchased extra retake | 12 months | That retake’s purchase date | How long that extra attempt remains usable |
| Certification validity | 3 years | The date you start the exam | How long a pass remains a live credential |
| Retake cooldown | 48 hours | When you finish an attempt | Earliest you may start the next attempt |
The 3-year clock is easy to misread. The Renewals article (19 May 2025) says all TryHackMe certifications are valid for 3 years from the date you start the exam, not from the date you pass, not from the date you buy, and not from the date you add the badge to LinkedIn. If you start on 1 March 2027 and pass on 2 March 2027, the validity anchor TryHackMe publishes is the start date.
After 3 years you renew. Published renewal options are:
- Complete a more advanced TryHackMe professional certification (coming soon)
- Pass the exam again
- Complete TryHackMe rooms related to professional certifications (coming soon)
Do not invent a fourth path. Two of the three listed options are still marked coming soon, so the durable published option today is to pass the exam again when renewal time comes.
Access, Money, and What Is Not Published
Exam attempts are valid for 12 months from purchase. The refund policy (29 Jun 2026) repeats that users have 12 months from the purchase date to complete the professional certification exam.
Professional certification purchases are non-refundable. That sits in the “Not Eligible for Refund” list with single course purchases. Voucher purchases are also strictly non-refundable. Do not buy SAL1 assuming a cooling-off period that applies to unused annual membership subscriptions; that 7-day membership rule is a different product line.
Check the live TryHackMe checkout and current subscription documentation for any voucher or discount terms; those commercial terms can change independently of SAL1's assessment rules.
This guide will not invent a dollar price. Visit tryhackme.com (the SAL1 certification page and your local checkout) for the price in your location. Further exam attempts can be purchased; the access article points you there for local pricing. There is no published official pass rate — if a third-party site quotes one, it is not a TryHackMe scoring-article figure.
After you pass, TryHackMe documents how to add the digital certification to LinkedIn (Licenses & Certifications), with issuing organisation TryHackMe and your credential URL from TryHackMe. That is a sharing step, not a scoring step.
Official Starting Points
- Scoring (29 Mar 2025): Exam Scoring
- Retakes (20 Jul 2026): Retakes
- Access (19 May 2025; older retake-timing wording): Certification Access
- Renewals (19 May 2025): Renewals
- Refunds (29 Jun 2026): Refund Policy
Under the newest TryHackMe Retakes article (20 July 2026), when can you start a SAL1 retake?
How long is a TryHackMe professional certification valid, and what date starts that clock?
Inside one 400-mark SOC Simulator scenario, how are the marks split?
Which statement about SAL1 access and money matches TryHackMe’s published policies?