The HTB Certified Defensive Security Analyst (HTB CDSA) is a hands-on certification for people who want to prove they can investigate, detect, and respond in realistic security environments. This guide is for HTB Academy learners, blue team candidates, SOC analysts in training, and anyone who learns best with a structured plan instead of random lab work. The goal is simple: help you use 30 days well. Not by cramming facts, but by building the habits the exam actually tests—log analysis, threat investigation, careful documentation, and making sound decisions under time pressure.
The CDSA exam is not a trivia test. It measures whether you can work through defensive security tasks in a practical way. That means your study plan should focus less on memorizing commands and more on understanding why you use a command, what output matters, and how to turn findings into conclusions. If you already have some exposure to Linux, Windows, networking, common logs, SIEM workflows, and basic incident response, you are in a good place to start. If those areas feel uneven, this guide will help you repair the gaps before exam day.
Who should use this HTB CDSA study guide
This plan is a good fit if you are in one of these groups:
- HTB Academy students who have completed or started defensive security paths and need a 30-day structure.
- Aspiring SOC analysts who want a practical certification instead of a multiple-choice exam.
- Hands-on learners who retain more through labs, investigations, and repetition than through passive reading.
- Candidates with uneven experience who know some topics well but need a checklist to cover weak areas.
This guide is less useful if you are looking for a shortcut. The CDSA rewards methodical practice. A rushed approach usually shows up in missed evidence, bad scoping, or weak reporting.
What the exam is really testing
At a high level, the CDSA tests whether you can think like a junior-to-mid defensive analyst in a realistic environment. That usually means five things:
- Technical understanding of logs, hosts, processes, accounts, alerts, and attacker behavior.
- Investigation flow, so you can move from a clue to a validated finding instead of guessing.
- Tool usage, because knowing a platform name is not enough; you need to extract useful evidence from it.
- Time management, since practical exams punish over-investigating one area and ignoring the rest.
- Clear reporting, because defensive work is only useful when findings are documented accurately.
This matters for your study plan. If you spend all 30 days reading notes and almost no time practicing investigations, you will likely feel informed but not ready.
Prerequisite knowledge and tools
You do not need to be an expert before starting, but you should be comfortable with the basics. Here is the minimum base that makes this plan work.
- Linux basics: file navigation, grep, cat, less, awk or cut, permissions, processes, cron, logs.
- Windows basics: event logs, services, scheduled tasks, PowerShell basics, user accounts.
- Networking: IPs, ports, DNS, HTTP/S, common protocols, basic packet flow.
- Security fundamentals: brute force, phishing, persistence, privilege abuse, lateral movement, web attacks.
- Log analysis: reading timestamps, correlating events, spotting anomalies, filtering noise.
- Incident handling: triage, validation, scoping, containment logic, documenting evidence.
Keep your toolset simple. You do not need ten overlapping note apps or a complex workflow. Use:
- One notes system for commands, log patterns, and mistakes.
- One checklist for daily progress and weak areas.
- One timer to practice working under limits.
- Hands-on labs as the center of your study, not as an extra.
The reason for keeping tools simple is practical. Exam prep fails when candidates spend too much energy organizing resources and not enough energy solving problems.
30-day HTB CDSA preparation plan
This plan assumes you can study about 2 to 4 hours on weekdays and more on weekends. If you have less time, keep the sequence the same and reduce volume, not quality. Every study day should include three parts:
- Review one topic briefly.
- Practice one hands-on task deeply.
- Document what confused you, what worked, and what signs led to the answer.
Days 1 to 6: Build the foundation
The first six days are about sharpening the basics you will use everywhere else.
- Day 1: Read the exam objectives and create your study tracker. List all domains. Mark each as strong, medium, or weak. This helps you avoid vague prep.
- Day 2: Review Linux investigation basics. Focus on auth logs, process review, suspicious files, cron jobs, and shell history. Practice tracing suspicious activity from logs to files.
- Day 3: Review Windows investigation basics. Focus on event logs, failed and successful logons, process execution, services, scheduled tasks, and PowerShell traces.
- Day 4: Review networking and web traffic. Practice reading HTTP requests, response codes, user agents, DNS records, and proxy or web server logs.
- Day 5: Study detection logic and alert triage. Work through examples where an alert is true positive, false positive, or inconclusive. Explain why.
- Day 6: Review note-taking and reporting. Write a short incident summary from a lab. Include what happened, how you know, what systems were affected, and what to do next.
By the end of this stage, you should not just recognize terms. You should be able to investigate a small scenario without feeling lost.
Days 7 to 16: Domain review and guided practice
This is the core learning phase. Each day should focus on one domain and one realistic workflow.
- Day 7: Authentication events. Trace failed logins, password spraying signs, account lockouts, and suspicious login times.
- Day 8: Endpoint activity. Review process chains, parent-child relationships, script execution, and suspicious binaries.
- Day 9: Persistence. Check startup items, scheduled tasks, services, cron, registry-related concepts if relevant, and hidden files.
- Day 10: Web attacks. Practice spotting SQL injection patterns, command injection signs, strange requests, unusual user agents, and admin path abuse.
- Day 11: Email and phishing indicators. Focus on sender anomalies, link analysis, attachment behavior, and what evidence supports actual compromise.
- Day 12: DNS and network anomalies. Review suspicious lookups, beacon-like behavior, odd external connections, and uncommon ports.
- Day 13: Lateral movement clues. Look for remote execution signs, credential use across systems, and unusual admin actions.
- Day 14: SIEM-style investigation day. Start from a single alert and build the full timeline using related events.
- Day 15: Reporting day. Take one completed investigation and write it cleanly. Focus on evidence, not assumptions.
- Day 16: Mixed mini-scenarios. Do short cases from different domains under time pressure.
The reason to group your learning this way is that defensive work is pattern-based. You get faster when you repeatedly see how the same type of attack appears across different logs and hosts.
Days 17 to 22: Practice questions, labs, and explanation review
Now you shift from learning topics to proving that you can apply them. Use timed practice. Do not pause every few minutes to check notes unless you are fully blocked.
- Day 17: Timed authentication and endpoint questions.
- Day 18: Timed web and network investigation questions.
- Day 19: Timed mixed-domain set.
- Day 20: Redo the questions you got wrong, but explain each answer before checking it.
- Day 21: Full lab or extended scenario. Work from alert to conclusion and write notes as if they will be graded.
- Day 22: Error log day. Review all mistakes from the week and group them by cause: weak concept, missed clue, bad time use, or careless reading.
After the study plan section, use one focused practice source rather than jumping between many low-quality sets. Practice with the relevant page only: Hack The Box HTB Certified Defensive Security Analyst (HTB CDSA) Practice Test
The key here is not volume alone. Fifty rushed questions teach less than ten carefully reviewed ones if you do not understand why your reasoning failed.
Days 23 to 26: Weak-area repair
This is the stage many candidates skip, and it is often the difference between passing and underperforming. Go back to your tracker and identify your three weakest areas. Then repair them directly.
- Day 23: Weak area one. Relearn the topic, do targeted exercises, and create a one-page summary in your own words.
- Day 24: Weak area two. Focus on investigation flow, not just commands.
- Day 25: Weak area three. Redo at least one scenario where you previously struggled.
- Day 26: Cross-over day. Practice a scenario that combines two or more weak areas.
Why this works: most people do not fail because they know nothing. They fail because one or two blind spots keep breaking their process. Repairing those weak spots gives a better return than reviewing topics you already know well.
Days 27 to 30: Final revision and exam readiness
Your final days should reduce noise and improve confidence. This is not the time for new deep topics unless you discover a major gap.
- Day 27: Run one realistic timed scenario. Practice staying calm, taking structured notes, and moving on when stuck.
- Day 28: Review your summaries: log locations, common attack signs, investigation steps, reporting structure, and frequent mistakes.
- Day 29: Light practice only. Do a few short questions and one small lab. Stop early. Fatigue hurts more than it helps this late.
- Day 30: Exam readiness check. Confirm environment, timing plan, note template, break plan, and sleep routine.
A good final revision phase feels controlled. If you are trying to learn everything in the last two days, your earlier plan was probably too passive.
How to review explanations without memorizing answers
This matters a lot for practical exams. If you only memorize the final answer to a question, you will struggle when the same concept appears in a different format.
Use this review method instead:
- Ask what clue mattered most. Example: was the real signal the unusual PowerShell command, the parent process, or the timestamp correlation?
- Ask what false path looked tempting. This trains judgment, not just recall.
- Restate the explanation in your own words. If you cannot explain it simply, you probably do not own the concept yet.
- Create one variation. For example, if the case used failed SSH logins, ask how the same attack might appear in RDP or VPN logs.
- Write the process, not just the result. “I checked auth logs, correlated source IPs, compared timestamps, then verified account behavior.”
This approach helps because the exam rewards transferable thinking. The exact same artifact may not appear, but the same logic often does.
Final-week readiness routine
In the last week, follow a steady routine instead of emotional studying.
- Start each day with one short review block. Use your own summaries, not long modules.
- Do one timed task. Even 30 to 45 minutes is enough to keep your pace sharp.
- Review one old mistake. Repetition prevents the same error from returning under stress.
- End with a written recap. Note one thing you improved and one thing to watch on exam day.
Also prepare your exam workflow. Decide how you will take notes, how long you will stay on one task before moving, and how you will mark items to revisit. These choices reduce panic because you are not inventing your process during the exam.
HTB-style skills checklist
Use this checklist as a simple readiness reference. If several items are still weak, delay the exam and fix them.
- I can investigate Linux auth and system logs without needing step-by-step help.
- I can review Windows event data and identify suspicious logons, execution, and persistence clues.
- I can read web and proxy logs and spot attack patterns or anomalies.
- I can correlate events across time, hosts, users, and IP addresses.
- I can tell the difference between evidence and assumption.
- I can explain why an alert is malicious, benign, or inconclusive.
- I can write a short incident summary that another analyst could act on.
- I can work under time pressure without losing structure.
- I know my weak areas and have practiced them directly.
- I have completed at least a few realistic timed scenarios before exam day.
FAQ
How many hours should I study each day?
For a 30-day plan, 2 to 4 focused hours on weekdays and longer sessions on weekends is a solid target. Quality matters more than raw hours. A distracted five-hour session is less useful than two focused hours with hands-on practice and review.
Can I prepare in 30 days if I am new to blue team work?
Possibly, but only if you already have basic Linux, Windows, and networking knowledge. If those are new too, 30 days may feel rushed. In that case, extend the foundation phase before booking the exam.
Should I spend more time on notes or labs?
Labs. Notes support the work, but labs build the skill. A good rule is about 70% hands-on practice and 30% review and documentation.
How do I know if I am ready?
You are close when you can complete timed scenarios with a clear process, explain your conclusions, and recover from mistakes without getting stuck. Readiness is less about feeling perfect and more about being consistent.
What if I keep getting practice questions wrong?
Look for the pattern. Are you missing concepts, misreading the question, rushing, or failing to correlate evidence? Fix the root cause. Do not just redo questions until the answer looks familiar.
Should I memorize commands?
Memorize the small set you use often, but focus on purpose and output. It is more important to know when to inspect auth logs or process trees than to remember ten obscure flags you rarely use.
What about retakes?
Retake policies can change, so check the current exam rules before planning around them. More important, if a first attempt does not go well, do a post-mortem. Identify whether the problem was knowledge gaps, workflow, time use, or stress. Then rebuild your plan around that.
What is the best practice strategy in the final week?
Short, timed, realistic practice. Avoid huge random question sets and avoid late-stage overload. Review your own mistakes, keep your process sharp, and protect your sleep.
The best CDSA preparation plan is not the most complicated one. It is the one you can follow every day, with real practice, honest review, and focused repair of weak areas. If you treat the exam like practical analyst work instead of a memory contest, your study time will be far more effective.
