Outline version: 2.0
Effective date: October 5, 2026
Applicable exam cohort: Candidates assigned the 70-question CCDL1 exam, comprising 25 tabletop questions and 45 practical investigation questions.
Certification Overview
Certified CyberDefender Level 1 (CCDL1) assesses the investigative skills and operational judgment needed for an entry-level Security Operations Center (SOC) analyst role.
You’ll interpret security alerts, examine technical evidence, connect findings across sources, and select appropriate investigation, escalation, and communication actions.
The exam combines two components: tabletop scenarios, which assess analyst decisions, and practical investigations, which assess the interpretation and analysis of supplied evidence.
Who the Exam Is For
CCDL1 is intended for aspiring SOC analysts, junior security analysts, and professionals moving into defensive cybersecurity roles.
You don’t need prior work experience or formal training to take the exam. CyberDefenders preparation courses and labs are optional, and you can purchase Exam Only. Both purchase options lead to the same exam and certification requirements.
Exam at a Glance
Characteristic | Specification |
Total questions | 70 |
Assessment components | Tabletop scenarios and practical investigations |
Question format | Tabletop: single-select, multi-select, matching, ranking, and structured-form responses. |
Language | English |
Scoring | Automatically scored |
Passing requirement | At least 70% overall |
Exam attempts | Your purchase includes two exam attempts. If you fail both, you may purchase a third and final attempt. If you fail the third attempt, you must re-enroll to take the exam again. |
Exam Structure and Weighting
Component | Questions | Contribution to Overall Score |
Tabletop scenarios | 25 | 40% |
Practical investigations | 45 | 60% |
Total | 70 | 100% |
Tabletop Scenarios
You review a security scenario and respond to questions about it. Tasks may ask you to interpret information, select actions, match related items, rank priorities, or complete specified response fields.
This component assesses how you apply SOC procedures and use available information to make decisions within an analyst’s responsibilities.
Practical Investigations
You’ll investigate supplied evidence in the exam environment and select the multiple-choice answer supported by your findings.
Evidence may include email messages, packet captures, host artifacts, security alerts, authentication records, cloud audit events, and other logs. Questions assess your ability to interpret that evidence and connect relevant findings.
Exam Timing
Component | Allocated Time |
Tabletop scenarios | 1 hour 15 minutes |
Break between components | 15 minutes |
Practical investigations | 5 hours |
Total, including the break | 6 hours 30 minutes |
You’ll have 6 hours 15 minutes to complete the two exam components, plus a 15-minute break between them. The total time is 6 hours 30 minutes.
Tabletop Assessment Objectives
This component assesses your ability to apply SOC procedures and make evidence-supported decisions in the following areas.
1. Alert Monitoring & Triage
Interpret alert details and distinguish suspicious activity from contextual information.
Evaluate severity and supporting evidence to select an appropriate triage priority.
Distinguish an initial observation from a supported incident conclusion.
2. Alert Enrichment & Context
Identify the asset, account, network, or service information needed to investigate an alert.
Select relevant enrichment sources and interpret the information they provide.
Relate contextual findings to the activity under investigation.
3. Threat Intelligence Consumption
Interpret threat indicators and their associated intelligence.
Evaluate the relevance and confidence of intelligence in a given scenario.
Use intelligence to support an investigative decision.
4. Escalation & Runbook Execution
Select an appropriate next step using the scenario’s runbook or response procedure.
Recognize when an issue requires escalation beyond the analyst’s authority.
Identify the information needed for an effective handoff.
5. Incident Documentation & Communication
Identify the facts needed in an incident record.
Distinguish evidence-supported findings from assumptions.
Select clear communication of incident scope, findings, and handoff information.
Practical Investigation Objectives
This component assesses your ability to examine technical evidence and connect findings across the following areas.
1. Email Threat Investigation
Interpret email headers, routing information, and authentication results.
Examine actual link targets and other evidence of deceptive email activity.
Investigate affected recipients and suspicious mailbox operations.
2. Network Traffic Analysis
Interpret packet fields, protocols, and communication streams.
Identify network behavior associated with reconnaissance, tunneling, or file transfer.
Analyze relevant operational technology or industrial control system traffic.
3. Endpoint & Forensic Investigation
Extract relevant findings from host artifacts and endpoint telemetry.
Interpret authentication activity, command history, and scheduled-task configuration.
Use endpoint evidence to establish what occurred on a system.
4. Identity & Access Investigation
Identify accounts and identities involved in suspicious activity.
Interpret authentication results and execution context.
Distinguish account privileges from permissions to access a resource.
5. SIEM & Log Analysis
Search and filter logs to locate evidence relevant to an investigation.
Interpret event fields and the operations they represent.
Correlate records across sources to reconstruct activity.
4. Threat Detection & Defensive Controls
Interpret detection-rule components and logic.
Evaluate what a detection or protective-control outcome establishes.
Classify activity using the evidence available.
5. Alert & Incident Analysis
Identify affected entities and relevant event timing.
Correlate findings to establish incident scope and sequence.
Distinguish supported conclusions from contextual narrative.
6. Cloud Security
Interpret cloud sign-ins, identities, and access-related evidence.
Investigate SaaS, mailbox, storage, and data-access operations.
Interpret cloud control outcomes and relevant deployment concepts.
Practical domains overlap. A question may assess several related skills, so these domains do not have separate percentage allocations. Each question contributes its points once to the overall score.
Scoring and Passing Requirements
Each component score is calculated as a percentage of the available points:
Component score (%) = (Awarded points ÷ Available points) × 100
Your overall result combines the tabletop and practical component percentages:
Overall score = (Tabletop score × 0.40) + (Practical score × 0.60)
For example:
Component | Component Score | Weighted Contribution |
Tabletop scenarios | 80% | 32 percentage points |
Practical investigations | 60% | 36 percentage points |
In this example, the overall score is 32 + 36 = 68%, which is below the passing requirement.
You must achieve at least 70% overall to pass. There is no separate passing threshold for an individual component or domain.
Your overall result is based on awarded points, rather than a simple percentage of questions answered correctly.
Preparing for the Exam
The assessment objectives above can help you identify areas that need further preparation. Your practice should cover both:
Decision-making: interpreting scenarios, prioritizing alerts, selecting runbook actions, and communicating findings.
Investigation: examining technical evidence, correlating sources, and identifying conclusions supported by the available data.
You can prepare through self-study, relevant experience, third-party resources, or optional CyberDefenders training and labs. You don’t need to complete CyberDefenders training to take the exam.
FAQs
What question formats are used?
The tabletop component includes single-select, multi-select, matching, ranking, and structured-form responses. Practical questions require you to investigate or interpret supplied evidence before selecting a multiple-choice answer.
Do I need to pass every domain separately?
No. The passing requirement is at least 70% of the weighted overall score. There are no separate domain or component passing thresholds.
Does the exam require a written incident report?
You don’t need to submit a complete written incident report. The exam assesses incident documentation and communication through scenario-based questions.
Do I need to complete CyberDefenders training first?
No. CyberDefenders training and labs are optional. With Exam Only, you’ll take the same exam and must meet the same passing requirement as those who purchase the preparation bundle.
How the Exam Outline Is Maintained
The exam is developed using job task analysis and input from subject matter experts. Its objectives connect SOC analyst tasks with the knowledge, skills, and decisions being assessed.
We review the competence framework and exam specifications periodically and whenever significant changes affect the role or assessment.
Registration
Explore the CCDL1 certification and purchase options.