312-39 Exam Information and Outline
EC-Council Certified SOC Analyst (CSA) certification
Syllabus Update Checked on: November 6, 2026
312-39 Exam Syllabus & Study Guide
Before you start practicing with our exam simulator, it is essential to understand the
official 312-39 exam objectives. This course outline serves as your roadmap.
The information below reflects the 2026 syllabus defined by
EC-Council.
Below are complete topics detail with latest syllabus and course outline, that will help you good knowledge about exam objectives and topics that you have to prepare. These contents are covered in questions and answers pool of exam.
- Exam Format
- 100 multiple-choice questions; 3 hours; passing score 70%
- Security Operations and Management (5%)
- SOC fundamentals: people, processes and technology
- SOC implementation
- Understanding Cyber Threats, IoCs and Attack Methodology (11%)
- Network-, host- and application-level attacks
- Indicators of compromise; attacker methodology
- Incidents, Events and Logging (21%)
- Incident and event fundamentals
- Local and centralized logging
- Incident Detection with SIEM (26%)
- SIEM solutions and deployment
- Detection use cases: application, insider, network, host, compliance
- Alert triage and analysis
- Enhanced Incident Detection with Threat Intelligence (8%)
- Threat intelligence types, sources and TIPs
- Incident Response (29%)
- IR process phases
- Responding to network, application, email, insider and malware incidents