C)CSA Exam Domains 2026: Complete Guide to All 7 Content Areas

How the 7 Modules Map to the Exam

The Certified Cybersecurity Analyst (C)CSA) credential from Mile2 is built on a blue-team curriculum. Its seven course modules cover defensive principles, forensics, malware, network traffic, defensive assessment, SIEM-driven analytics and purple-team collaboration. This guide walks through each one, what it asks of you, and how to prepare for it.

One point of honesty up front: the seven areas below are the official course modules, and we use them here as unweighted study categories. Mile2's public material does not publish a verified percentage weighting per domain, so any article that gives you precise domain percentages for this exam is guessing. Treat all seven as fair game and allocate study time according to your own gaps, not an imagined blueprint.

If you are still orienting yourself on the credential itself, our explainers on what C)CSA certification is and what C)CSA stands for cover the basics before you dive into the modules.

Format, Fee and Delivery Mechanics

Before studying content, understand the container it arrives in. The verified facts are straightforward:

A few things are not verified, and you should confirm them with Mile2 rather than assume: whether the exam is open-book, whether a calculator is permitted, whether questions are adaptive, what proctoring rules apply, and how accommodations are handled. The $550 figure is a combo price, not a verified exam-only price, so budget accordingly. For a fuller cost picture, see our C)CSA certification cost breakdown, and for the score mechanics see what you need to pass.

On eligibility, Mile2 suggests prior knowledge in security, forensics, incident handling and testing, but no mandatory Mile2 course, degree, experience-hour requirement or reference requirement has been verified. Details are in our C)CSA requirements guide.

Domain 1: Blue Team Principles

This module establishes the defender's mindset that the rest of the course builds on. Expect questions that test whether you understand what a blue team actually does day to day, how defensive work is organized, and how monitoring, detection and response fit together.

Because this is the entry module, scenario questions here often ask for the best first action or the most appropriate next step in an incident. Practice reading each option as a sequencing problem: which step logically comes before the others?

Domain 2: Digital Forensics

Forensics is where analytical discipline is tested. The core idea is preserving evidence and reconstructing events without altering what you are examining. Candidates who have only done live-response work sometimes underestimate the procedural rigor expected here.

Domain 3: Malware Analysis

This module moves from evidence handling to understanding hostile code. At the analyst level, the emphasis is on recognizing malware behavior and classifying it, not on writing exploits. Know the difference between examining a sample without running it and observing it while it executes in a controlled environment.

Questions here tend to hinge on choosing the right technique for a stated goal. If the goal is to avoid executing a sample, static methods apply; if the goal is to watch network calls or file changes, a controlled dynamic approach fits.

Domain 4: Traffic Analysis

Network traffic is often the ground truth during an investigation, and this module tests whether you can read it. Expect to interpret what normal looks like so you can spot what is not, and to understand how captured traffic supports detection and forensics.

Solid protocol fundamentals pay off disproportionately here. If TCP handshakes, DNS behavior and common application protocols feel shaky, shore those up first, since later SIEM and detection topics assume them.

Domain 5: Assessing the Current State of Defense within an Organization

This module shifts from reactive analysis to evaluating how well an organization is protected right now. It asks you to think like an assessor: where are the gaps, how do you measure defensive maturity, and how do you communicate findings in a way that drives improvement.

Domain 6: Leveraging SIEM for Advanced Analytics

A note on naming: Mile2's summary list spells this module's title as "Advances Analytics," which differs from its detailed heading. We use the module's listed name in our domain index, but the subject matter is advanced analytics with a SIEM. If you see both spellings in Mile2's own materials, they refer to the same module.

This is where data volume meets detection logic. The SIEM is the central platform that aggregates logs and events, and the module focuses on turning that raw telemetry into actionable detections.

Many candidates find this module the most practical because it ties together traffic, host and forensic evidence. Our difficulty guide for the C)CSA exam discusses why integrative modules like this one can feel harder than isolated-topic ones.

Domain 7: Defeating the Red Team with Purple Team Tactics

The final module brings offense and defense together. Purple teaming is the practice of red and blue teams collaborating so that attack simulations directly improve detection and response. Here you are tested on how adversary behavior informs defensive tuning.

Think of this module as the capstone: it assumes you can already analyze traffic, interpret SIEM data and assess defensive posture, and asks how to improve all of it through structured collaboration.

Sequencing Your Preparation Around the Modules

Because the modules build on one another, order matters more than raw hours. Here is one way to sequence study around the specific content, adjusted to your own background.

Adjust the pace to your experience; someone already working in a SOC may compress the early weeks. For a broader plan, see the C)CSA study guide, and keep the C)CSA cheat sheet handy for last-minute review. Finish with timed sets on our C)CSA practice test platform to get used to 100 questions in about two hours, roughly a minute and a bit per question.

Where These Skills Show Up in Hiring

The seven modules read like a job description for defensive security roles. Employers building monitoring and response capability tend to look for people who can triage alerts, investigate incidents, work with a SIEM and contribute to detection improvement. Titles you may see include SOC analyst, incident responder, threat hunter and security operations roles that blend monitoring with investigation.

Be cautious with salary claims. Mile2's brochure includes a salary figure, but it should not be read as current earnings for certification holders, and we do not publish it as such. For a realistic view of how to weigh pay and career value, read our salary guide, the worth-it ROI analysis, and our overview of C)CSA jobs.

Renewal and Keeping the Credential Active

The certification runs on a three-year renewal cycle. Mile2's central policy offers two routes: 60 documented CEUs over the three years, or taking the latest exam, along with any applicable fee and agreement to professional policy. One caution: the course PDF uses wording that reads as though both routes are required, which conflicts with the central policy. Verify the current rule with Mile2 before planning your renewal.

Frequently Asked Questions