Free study guide

EC-Council 312-39 Study Guide

EC-Council Certified SOC Analyst (CSA) 312-39

EC-Council Certified SOC Analyst (CSA), exam 312-39, tests the skills of a Tier I or Tier II analyst in a security operations center. It covers SOC operations, cyber threats and IoCs, log management, SIEM detection and alert triage, threat intelligence and hunting, incident response, investigation basics and cloud SOC tooling. It suits current and aspiring SOC analysts and others moving into security monitoring roles.

  • Exam code 312-39
  • Associate level
  • 8 exam domains

This guide is free, with no sign-up. It explains every EC-Council 312-39 exam topic in plain English, one chapter at a time. Read them in order or jump straight to the topic you need.

  • 8chapters
  • 35topics
  • 8diagrams and exhibits
  • 2 h 49 minfast track
Start with Security Operations and Management
  • Every topic follows the same simple pattern: what it is, how it works, common mistakes
  • Diagrams and real command output where a picture explains it best
  • Exam tips and worked subnetting and IPv6 practice, with answers

How the exam is weighted

Each domain is worth this share of the exam, so spend your study time in proportion. Select a domain to open its chapter.

Chapters

Open a chapter to see its topics and how long each takes.

1Security Operations and Management3 topics · 15 min fast trackSecurity management, SOC functions, workflow, models, maturity and KPIs.
  1. 1Security Management and the SOC5 min
  2. 2SOC Workflow, People, Process, Technology and SOC Models5 min
  3. 3SOC Maturity, KPIs, Challenges and Best Practices5 min
Read the chapter overview →
2Understanding Cyber Threats, IoCs, and Attack Methodology4 topics · 20 min fast trackThreat actors, network, host, application, email and insider TTPs, IoCs, kill chain and ATT&CK.
  1. 1Cyber Threats and Network Attack TTPs5 min
  2. 2Host and Application Attack TTPs5 min
  3. 3Social Engineering, Email and Insider Attack TTPs5 min
  4. 4Indicators of Compromise and Attack Frameworks5 min
Read the chapter overview →
3Log Management5 topics · 25 min fast trackLog approaches, Windows, Linux and Mac logs, device, web, database and email logs, and central logging.
  1. 1Log Management Importance and Approaches5 min
  2. 2Windows, Linux and Mac Logs5 min
  3. 3Firewall and Router Logs5 min
  4. 4Web Server, Database and Email Logs5 min
  5. 5Centralized Logging5 min
Read the chapter overview →
4Incident Detection and Triage6 topics · 28 min fast trackSIEM architecture, deployment, use cases, detection, AI rules, triage and reports.
  1. 1SIEM Importance, Architecture and Types5 min
  2. 2Deploying a SIEM and Managing Use Cases5 min
  3. 3Incident Detection with SIEM5 min
  4. 4Using AI to Generate SIEM Rules5 min
  5. 5Alert Triage and Analysis4 min
  6. 6SOC Dashboards, Visualization and Reports4 min
Read the chapter overview →
5Proactive Threat Detection5 topics · 22 min fast trackThreat intelligence types, sources, TIPs, intel driven SOC, hunting frameworks and tools.
  1. 1Threat Intelligence Concepts, Types and Strategies4 min
  2. 2Threat Intelligence Sources and Platforms4 min
  3. 3Threat Intelligence Driven SOC and Use Cases4 min
  4. 4Threat Hunting and Hunting Frameworks5 min
  5. 5Threat Hunting with PowerShell, YARA and Tools5 min
Read the chapter overview →
6Incident Response6 topics · 30 min fast trackPhases, network, application, email, insider and malware response, playbooks, EDR and XDR (25%).
  1. 1Incident Response and Its Phases5 min
  2. 2Responding to Network Security Incidents5 min
  3. 3Responding to Application and Email Security Incidents5 min
  4. 4Responding to Insider and Malware Incidents5 min
  5. 5SOC Playbooks in Incident Response5 min
  6. 6Enhanced Incident Response with EDR and XDR5 min
Read the chapter overview →
7Forensics Investigation and Malware Analysis3 topics · 15 min fast trackEvidence handling, network, application, email and insider investigations, and malware analysis (5%).
  1. 1Forensic Investigation and Investigating Network Incidents5 min
  2. 2Investigating Application, Email and Insider Incidents5 min
  3. 3Malware Analysis, Static and Dynamic5 min
Read the chapter overview →
8SOC for Cloud Environments3 topics · 14 min fast trackAzure and Microsoft Sentinel, AWS Security Hub and GuardDuty, Google SCC and Security Operations, worth 5%.
  1. 1Azure SOC Architecture and Microsoft Sentinel4 min
  2. 2AWS SOC Architecture and AWS Security Hub5 min
  3. 3GCP SOC, Security Command Center and Google Security Operations5 min
Read the chapter overview →

Ready for more practice?

The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.