Certified SOC Analyst certification (CSA): exam 312-39, cost and requirements

What is the Certified SOC Analyst certification?

Certified SOC Analyst, CSA, is EC-Council’s certification for people who work in a security operations centre. EC-Council names SOC analyst roles at L1, L2 and L3 — Tier I to Tier III — as the target, alongside related roles such as cybersecurity analyst and network defense analyst.

The current exam is 312-39, and EC-Council’s published exam blueprint is version 2 (CSA v2). The content follows the work of a SOC: log management, detecting and triaging incidents, proactive threat detection, incident response, and the forensic and cloud basics around them.

In EC-Council’s portfolio CSA is a blue-team certification. EC-Council suggests CND, ECIH, CHFI and CTIA as further blue-team certificates after CSA, and points to CEH for those who want to understand red teams, ethical hacking and penetration testing.

Source: EC-Council — Certified SOC Analyst (CSA). Checked 8 October 2026.

How much does the Certified SOC Analyst certification cost?

EC-Council does not list an exam-only price on the CSA page. Because enrolment in official training is required, the price you see is a course package: the Single On-Demand Certification Course starts at $999, the Single Live Online Certification Course at $1,399, and Unlimited On-Demand Certification Courses at $3,999.

The page does not break down what each package contains. Its general FAQ states that base packages include video instruction, eCourseware, exam vouchers and six months of access to official labs; confirm the contents of the package you choose before you buy.

After certification there is a recurring cost: EC-Council charges an annual continuing education fee of USD $80 if you hold at least one certification under its ECE policy, and CSA is one of them.

Source: EC-Council — Certified SOC Analyst (CSA). Checked 8 October 2026.

What is the CSA exam format?

Exam 312-39 has 100 multiple-choice questions and a test duration of 3 hours. That is 1 minute 48 seconds per question on average — enough to read each question twice, so careful reading pays off more than speed.

EC-Council lists the exam’s availability as the EC-Council Exam Portal, and its certification site states that the exam is available at the ECC Exam Centre. EC-Council does not publish the exam languages on the CSA page.

Source: EC-Council — Certified SOC Analyst (CSA). Checked 8 October 2026.

Certified SOC Analyst passing score

EC-Council states that a minimum score of 70% is required to pass. On 100 questions that corresponds to 70 correct answers, assuming every question counts equally; EC-Council does not describe a scaled score for CSA.

For preparation, the two heaviest domains in the blueprint — incident detection and triage, and incident response, at 25 per cent each — together make up half the exam. A candidate weak in either of them will find 70% hard to reach.

Source: EC-Council — Certified SOC Analyst (CSA). Checked 8 October 2026.

What is on the CSA exam?

EC-Council’s CSA v2 exam blueprint gives eight domains. The weight sits in the middle of the SOC workflow: incident detection and triage and incident response carry 25 per cent each, log management 15 and proactive threat detection 12, while four supporting domains — operations and management, threats and attack methodology, forensics and malware, and cloud SOC — share the remaining 23 per cent.

The weightings as published:

• Security Operations and Management — 5%
• Understanding Cyber Threats, IoCs, and Attack Methodology — 8%
• Log Management — 15%
• Incident Detection and Triage — 25%
• Proactive Threat Detection — 12%
• Incident Response — 25%
• Forensics Investigation and Malware Analysis — 5%
• Introduction to Cloud SOC — 5%

Source: EC-Council — CSA v2 exam blueprint. Checked 8 October 2026.

Certified SOC Analyst requirements

EC-Council states that enrolment in the official training program is required to obtain the CSA certification. The CSA page names no separate experience route, so plan on the course as part of the certification.

For knowledge, EC-Council states that you must possess foundational knowledge of cybersecurity or IT, and recommends a basic knowledge of cybersecurity and networking, including networking concepts, the TCP/IP protocol suite and security technologies.

Source: EC-Council — Certified SOC Analyst (CSA). Checked 8 October 2026.

How long is the CSA certification valid?

EC-Council states that all its certifications are valid for three years from the date of certification. CSA falls under the EC-Council Continuing Education (ECE) policy, which requires 120 credits per certification within the three-year period.

On top of the credits, ECE requires an annual continuing education fee of USD $80 for members who hold at least one certification under the ECE policy. Both are conditions of the ECE scheme, so budget the fee for each year you hold the credential.

Source: EC-Council — ECE policy. Checked 8 October 2026.

CSA study materials and training

Because training is mandatory, the official material comes with the course: EC-Council’s eCourseware, video instruction and lab access, delivered on demand or live online. The CSA course is organised in eight modules, from security operations and management to SOC for cloud environments, corresponding to the eight blueprint domains.

Use the CSA v2 blueprint as your checklist. Its weightings show where time pays off: log management, detection and triage, and incident response together account for 65 per cent of the exam.

Source: EC-Council — CSA v2 exam blueprint. Checked 8 October 2026.

Certified SOC Analyst vs CEH

Both are EC-Council certifications, but they look at an attack from opposite sides. CSA is the blue-team credential for detecting, triaging and responding to incidents in a SOC. EC-Council points to CEH for understanding red teams, ethical hacking and penetration testing.

The exams differ in size too. The CEH knowledge exam is 125 multiple-choice questions in 4 hours, delivered online via the ECC exam portal, with an optional practical exam on top; CSA is 100 multiple-choice questions in 3 hours.

Neither is a prerequisite for the other. Pick by role: SOC work points to CSA, offensive testing to CEH.

Source: EC-Council — Certified Ethical Hacker (CEH). Checked 8 October 2026.

Certified SOC Analyst practice questions

Certsqill’s CSA practice questions for exam 312-39 are expert-developed, with an explanation for every option, and weighted the way EC-Council’s v2 blueprint weights the eight domains.

CSA questions people ask

What is the CSA exam code?

312-39. Source: EC-Council, checked 8 October 2026.

How many questions are on the Certified SOC Analyst exam?

100 multiple-choice questions in 3 hours. Source: EC-Council, checked 8 October 2026.

What is the CSA passing score?

70%. Source: EC-Council, checked 8 October 2026.

How much does the Certified SOC Analyst certification cost?

EC-Council lists course packages starting at $999 (on-demand), $1,399 (live online) and $3,999 (unlimited on-demand); it states no exam-only price. Source: EC-Council, checked 8 October 2026.

Do I have to take EC-Council training for CSA?

Yes. EC-Council states that enrolment in the official training program is required to obtain the CSA certification. Checked 8 October 2026.

What does the CSA exam cover?

Eight domains; incident detection and triage and incident response weigh 25% each, log management 15%. Source: EC-Council CSA v2 exam blueprint, checked 8 October 2026.

How long is CSA valid?

Three years, renewed with 120 ECE credits and a USD $80 annual CE fee. Source: EC-Council ECE policy, checked 8 October 2026.

Which certifications come after CSA?

EC-Council suggests the blue-team certificates CND, ECIH, CHFI and CTIA after CSA, and CEH for the red-team side. Source: EC-Council CSA page, checked 8 October 2026.

Where is the CSA exam taken?

Through the EC-Council Exam Portal / ECC Exam Centre. Source: EC-Council, checked 8 October 2026.

Where the EC-Council CSA certification fits

The EC-Council CSA certification sits on the defensive, blue-team side of EC-Council’s portfolio. EC-Council maps it to SOC analyst roles at levels L1, L2 and L3, and suggests other blue-team certifications — CND, ECIH, CHFI and CTIA — as next steps after CSA. For the offensive side, EC-Council points to CEH instead.

One thing to plan for early: EC-Council states that enrollment in the official training programme is required to obtain the CSA certification, so the exam is bought as part of a course package rather than on its own.

Source: EC-Council — Certified SOC Analyst (CSA). Checked 8 October 2026.

Where to focus your preparation

The CSA v2 blueprint puts half of the exam on two topics: incident detection and triage (25%) and incident response (25%). Log management adds another 15%. If your study time is limited, those three areas are where it pays off — they are also the daily work of a SOC analyst.

The included official labs are the best place to practise them hands-on: reading logs, triaging alerts and walking through a response.

Source: EC-Council — CSA v2 exam blueprint. Checked 8 October 2026.

Why dumps are a poor way to prepare

Dumps that claim to contain live CSA questions are unreliable: you cannot check whether the answers are right or from the current v2 blueprint. More importantly, the exam is meant to show that you can detect and triage incidents — memorised answers do not help you do that in a real SOC, and the 70% pass mark is measured across all eight modules.

More CSA questions

Can I take the EC-Council CSA exam without training?

EC-Council states that enrollment in the official training programme is required to obtain the CSA certification. Source: EC-Council, checked 8 October 2026.

Which CSA topics carry the most weight?

Incident detection and triage and incident response, at 25% each in the CSA v2 blueprint, followed by log management at 15%.