CDSA Study Plan
SOC operations, log analysis, and incident handling, hands-on. A free, day-by-day CDSA schedule built from the official HTB Academy: SOC Analyst Job Role Path syllabus, scaled to your exam date and weekly hours.
- Approx. cost
- $490–$1,260
- Difficulty
- ♥♥♥♥♥
- Study time
- about 128h
- Start level
- Intermediate
> How long does CDSA take?
The plan assumes about 128 study hours. Here is how that stretches across different weekly schedules.
| Hours per week | Time to finish |
|---|---|
| 5 hours | about 26 weeks (6.0 months) |
| 10 hours | about 13 weeks (3.0 months) |
| 15 hours | about 9 weeks (2.1 months) |
| 20 hours | about 7 weeks (1.6 months) |
| 30 hours | about 5 weeks (1.2 months) |
> CDSA exam format
Hack The Box · HTB Academy: SOC Analyst Job Role Path
- Security analysis, SOC operations & incident handling across multiple real networks
- Must complete 100% of the SOC Analyst job-role path first
- No multiple-choice questions; a letter of engagement sets the scope
- Commercial-grade incident report required to pass
> CDSA syllabus and study hours
Every topic in the plan, in order, with its baseline hours. The planner shrinks or stretches these to fit your dates.
SOC Fundamentals
The core toolkit: incident handling, SIEM, and log sources.
- Incident Handling Process6h · learn
- Security Monitoring & SIEM Fundamentals6h · learn
- Windows Event Logs & Finding Evil3h · learn
- Introduction to Threat Hunting & Hunting With Elastic3h · learn
- Understanding Log Sources & Investigating with Splunk3h · learn
Network & Traffic Analysis
Reading the wire: from AD attacks to IDS/IPS rules.
- Windows Attacks & Defense9h · learn
- Intro to Network Traffic Analysis8h · learn
- Intermediate Network Traffic Analysis10h · learn
- Working with IDS/IPS6h · learn
Malware & Detection Engineering
Analyze malicious code and write the rules that catch it.
- Introduction to Malware Analysis5h · learn
- JavaScript Deobfuscation6h · learn
- YARA & Sigma for SOC Analysts6h · learn
Forensics & Reporting
From artifacts to a report a client can act on.
- Introduction to Digital Forensics4h · learn
- Detecting Windows Attacks with Splunk13h · learn
- Security Incident Reporting3h · learn
Training Grounds
Practice investigation end to end.
- Splunk/Elastic investigation drills14h · lab
- Static analysis on sample malware10h · lab
Final Boss Prep
A checklist and a full incident-response dry run.
- Build a SOC investigation checklist5h · review
- Timed mock incident response8h · review
> Where to practise for CDSA
Each task in your plan lists practice labs for its own topic. These are the best places to put in extra hands-on hours:
- Blue team challenges (CyberDefenders)
- Boss of the SOC datasets (BOTS) (Splunk)
- Packet capture exercises (Malware-Traffic-Analysis)
- SOC Level 1 path (TryHackMe)
> CDSA exam-day checklist
General logistics for exam week. The official exam guide always takes priority if it differs.
One to two weeks before
- Schedule your exam and add the start time, time zone and deadline to your calendar
- Read the official exam guide end to end: rules, allowed and banned tools, and what counts as proof
- Practise Splunk and Elastic investigations and basic malware triage
- Complete a full-length timed practice run on your exam setup
- Finalize your note-taking setup and templates (see the notes starter below)
- Build and review your cheat sheets and command references
- Arrange time off, tell people you will be unavailable, and plan your meals ahead
Machine and network
- Charge and test a backup device or phone hotspot, and know how to contact support if your connection drops
- Plug in your laptop and turn off sleep, updates and notifications for the exam
- Test the VPN or lab connection early and know how to reconnect after a drop
- Update your attack VM, take a clean snapshot and keep a spare
- Install and test every tool you plan to use, and check none of them are banned
- Test your screenshot hotkeys and make sure you have plenty of free disk space
During the exam
- Sleep well the night before, and skip last-minute cramming
- Prepare food and water, and set timers for break reminders
- Read the brief and scope carefully before you touch anything
- Write notes and capture proof as you go, not at the end
- Time-box each target and move on when stuck. You can come back later
Report and submission
- Copy your report template and fill in the easy parts (scope, methodology) while you work
- Check every finding has reproducible steps and screenshots
- Proofread: could someone else follow each step?
- Export in the exact format and naming the exam guide requires
- Submit with a buffer before the deadline and confirm it was received
Suggested exam-day rhythm
- Before you start. Check how long the exam window is and work backwards from the deadline.
- Daily. Fixed working blocks of about 90 minutes, a 10-minute break after each, and a proper stop at night.
- Each day. Update notes, list your next ideas and back up your evidence.
- Near the end. Stop new attacks early enough to verify findings and write the report.
- Submission. Submit with a buffer before the deadline and confirm it was received.
▶ Open the interactive CDSA exam kit
The kit lets you tick items off, download a notes starter and report template, and see a readiness score from your plan progress.
> Passed CDSA with PWN PATH
No CDSA debriefs yet
Passed a cert? A short debrief helps the next learner plan their own run, and it only takes a couple of minutes.
▶ Share my debriefDebriefs are self-reported. See all pass stories.
> Frequently asked questions
How long does it take to prepare for CDSA?
PWN PATH builds the CDSA plan on about 128 study hours. At 10 hours a week that is roughly 13 weeks, and at 20 hours a week roughly 7 weeks. Your own timeline depends on how much of the material you already know.
What is the CDSA exam like?
Security analysis, SOC operations & incident handling across multiple real networks. Must complete 100% of the SOC Analyst job-role path first. No multiple-choice questions; a letter of engagement sets the scope. Commercial-grade incident report required to pass.
How hard is CDSA?
We rate CDSA 3 out of 5. It suits analysts who want a practical SOC path covering SIEM, forensics and malware. Basic security knowledge. Must finish the whole job-role path.
How much does CDSA cost?
HTB Academy subscription plus a $210 exam voucher. Silver Annual is about $490–550 with a voucher included; some advanced paths need Gold. Prices are approximate, in US dollars unless a currency is shown, and change often. Confirm with the vendor before you buy.
What should I study first for CDSA?
Start with the "SOC Fundamentals" phase: Incident Handling Process, Security Monitoring & SIEM Fundamentals, Windows Event Logs & Finding Evil. The planner puts topics in a sensible order and scales the hours to the time you have.
What are the prerequisites for CDSA?
Basic security knowledge. Must finish the whole job-role path.
What should I do the week before the CDSA exam?
Re-read the official exam guide for rules and banned tools, test your machine, network and VPN or lab connection, finish a full timed practice run, finalize your notes and cheat sheets, and plan your meals, breaks and sleep. The exam-day checklist on this page covers it step by step.
How should I handle breaks and sleep during the CDSA exam?
Before you start: Check how long the exam window is and work backwards from the deadline. Daily: Fixed working blocks of about 90 minutes, a 10-minute break after each, and a proper stop at night. Each day: Update notes, list your next ideas and back up your evidence. Near the end: Stop new attacks early enough to verify findings and write the report.
What should I take after CDSA?
CDSA is one of the furthest steps in its track. The roadmap shows related certs in other tracks.
Is the PWN PATH study planner free?
Yes. There are no accounts and no sign-up. Your plan and progress are saved in your browser, and you can export a backup file, add the schedule to your calendar or print it.
> Plan your path
Good stepping stones before CDSA:
More in blue team & soc:
Not sure CDSA is right for you? Take the one-minute cert quiz.