196 practice questions for EC-Council Certified SOC Analyst v2 (CSA), exam 312-39, with full explanations.
Every question comes with the correct answer, the reasoning behind it, and a short note on why each wrong option is wrong. Work through it once with the answers, then again with the questions-only copy under exam conditions.
- 196 questions mapped to the CSA v2 exam blueprint
- Answers and explanations for every question, including the wrong options
- A questions-only PDF for timed practice runs
- Instant delivery by email the moment you check out
- Free monthly updates for as long as the exam is live
- Pass or your money back
A 312-39 attempt costs US$250. This pack is US$39, paid once.
Try 10 questions free before you buy.
Last updated September 2026 · 196 questions
What makes the CSA hard
CSA v2 is the Tier 1 and Tier 2 SOC analyst exam, and the v2 study material reorganised it into eight modules, with incident detection and triage and incident response carrying half the exam between them at 25% each.
Detection covers SIEM architecture and deployment, correlation rules including AI-generated rules, alert triage and dashboards, with the classic true positive, false positive, false negative questions. Response covers the incident response lifecycle, containment, eradication, recovery and post-incident documentation.
Log Management, Proactive Threat Detection and Cloud Security Operations follow, the last of which tests Microsoft Sentinel, AWS Security Hub and Google Security Command Center side by side, so it pays to keep straight which service belongs to which cloud. EC-Council’s own exam blueprint lists these eight modules without publishing official percentage weightings, and the passing score is 70%.
About the exam
312-39 v2 (Certified SOC Analyst) earns the EC-Council CSA certification. It covers security operations and management, cyber threats and indicators of compromise, log management, incident detection and triage with SIEM, proactive threat detection, incident response, forensics, and cloud security operations. There are no prerequisites with official training; self-study candidates need one year of security experience and an eligibility application.
Exam modules
- Security Operations and Management
- Understanding Cyber Threats, IoCs, and Attack Methodology
- Log Management
- Incident Detection and Triage
- Proactive Threat Detection
- Incident Response
- Forensic Investigation and Malware Analysis
- SOC for Cloud Environments
EC-Council publishes these eight modules but does not publish percentage weightings for them. 100 multiple choice questions, 180 minutes, passing score 70%, US$250 per attempt, ECC Exam Portal or Pearson VUE with remote proctoring available, certification valid for three years with EC-Council continuing education.
Reviews
There are no reviews yet.