Skip to content

Back to the catalog

bencteux.frwriteup

Hack The Box Certified Defensive Security Analyst (HTB CDSA) review

A personal review of Hack The Box's Certified Defensive Security Analyst (CDSA) certification, an entry-level SOC analyst / incident responder credential under HTB's SOC Analyst Job-Role Path. The author details the 15-module course covering SIEM/SOC fundamentals, network analysis, Active Directory attack & defense, and ELK/Splunk labs, critiques several technical errors in the material, and describes the 7-day practical exam involving two incidents with 20 flags and a mandatory incident report.

TL;DR First-hand review of HTB's entry-level blue-team CDSA certification, covering course content quality and the two-incident, 7-day practical exam.
Open original ↗
Document

What it is

A first-hand review of HTB's Certified Defensive Security Analyst (CDSA), an entry-level blue-team cert backed by the "SOC Analyst Job-Role Path" (15 modules), written by a practitioner who already knew most of the material. The value here over the summary is the concrete decision data: cost structure, exam mechanics, pass threshold, and time budget.

Preconditions / cost

Certification is gated behind an annual Silver subscription at $490, which also unlocks other job paths (CPTS, CWES) and includes one certification voucher (CDSA, CWES, or CPTS). The author paid $430 during a summer discount that also bundled a free CJCA voucher. Lab access is via VPN with no per-lab time limit as long as the subscription is active.

What to expect

Course: 15 modules, non-sequential, one rated Hard, alternating text and labs. Author completed it in ~40 hours (biased low by prior experience). HTB's per-module time estimates are unreliable — some modules take minutes, others hours, so the progress percentage does not reflect real effort.

Exam:

  • Two incidents, each with provided trace sources.
  • First incident has 20 flags; 16/20 needed to pass.
  • Both incidents require a written report with mandatory sections: executive summary, business impact, detailed timeline.
  • 7 calendar days, no pause. Author used ~5 days working most of each day, found 19/20 flags, and got a pass result 9 calendar days after submission.

What to do

Two pieces of concrete prep advice the author would give themselves:

  • Have a time-efficient method for writing the timeline with commands and screenshots before starting.
  • Prepare a report template in advance.
  • Do not underestimate exam time — the author overran their own estimate despite knowing the material.

Strongest content to actually learn from: the ELK and Splunk queries (described as field-realistic and worth taking notes on) and the skill-assessment / Active Directory Attack & Defense labs.

Caveats

The author flags factual errors to not take at face value: in SIEM/SOC fundamentals, false-positive rate is misused to set alert severity (not how it's done professionally); in Network Analysis, a network tap is wrongly classified as active (it is passive) and there are OSI model example errors. Content is uneven — duplicated material (Windows vs. Linux static analysis) and trivial end-of-section questions (e.g. packet counts). One lab appeared to require an unintended SSH local port-forward to complete.

Technologies named here

Techniques named here

  • SIEM and SOC fundamentals
  • Network Analysis
  • Static analysis for Windows and Linux
  • Active Directory Attack & Defense
  • AD Security Assessment
  • Purple Team Exercises
  • User Awareness Training
  • DMARC
  • Incident timeline reconstruction

Related in Learning