1.1 Current SAL1 Exam Facts

TryHackMe Security Analyst Level 1 SAL1

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current SAL1 Exam Facts 1.2 24-Hour Window, Check-In, and Delivery 1.3 Scoring, Retakes, Validity, and Access 1.4 MCQ Section Strategy

2 SOC Simulator Exam Skills

2.1 Analyst VM, Splunk, and Dynamic Alerts 2.2 Classification and Escalation Scoring 2.3 Case Reports and Investigation Notes

3 Network Essentials

3.1 OSI, TCP/IP, Devices, and the Three-Way Handshake 3.2 HTTP, TLS, VPN, Web Browsing, and Email Transmission

4 Operating System Basics

4.1 Windows and Linux Architecture, Auth, Filesystems, Processes 4.2 Active Directory and Event Logs for Tracing Activity

5 Cryptography, Cloud, Web and Scripting Basics

5.1 Encoding, Encryption, Hashing, and Decoding Tools 5.2 VMs vs Hosts, Cloud vs Virtual Hosting, SaaS and IaaS 5.3 Web Apps, APIs, JSON/XML, Scripts vs Compiled Programs

6 Cybersecurity Fundamentals and MITRE ATT&CK

6.1 CIA, Least Privilege, Human Factors, Log4Shell, EternalBlue 6.2 Navigating MITRE ATT&CK: Tactics, Techniques, Sub-techniques 6.3 Mapping Real Attacks onto ATT&CK Techniques

7 Kill Chain, NIST CSF, and Attack Indicators

7.1 Cyber Kill Chain Stages vs MITRE ATT&CK 7.2 NIST CSF: Identify, Protect, Detect, Respond, Recover 7.3 IoC vs IoA and the Pyramid of Pain

8 Social Engineering and Network Attacks

8.1 Phishing: Impersonation, Typosquatting, Spoofing, Header Analysis 8.2 SPF, DKIM, DMARC, and Email Authentication Results 8.3 Port Scanning, DDoS, and Man-in-the-Middle 8.4 DNS Poisoning, ARP Spoofing, Exfiltration, and C2 Traffic Patterns

9 Web Exploitation and Endpoint Attacks

9.1 Client vs Server Vulnerabilities, XSS, and SQL Injection 9.2 Code Injection, Path Traversal, Input Validation, Patching, WAF 9.3 Initial Access (RDP/SSH), Persistence, Privilege Escalation 9.4 Credential Theft, Mimikatz, Sysmon, and Auditd

10 Command and Control, Malware, and LOLBAS

10.1 Forward vs Reverse Shells, Beaconing, Metasploit, Cobalt Strike 10.2 Malware Types, Static vs Dynamic Analysis, LOLBAS

11 EDR, Firewalls, and WAF

11.1 EDR vs AV, Telemetry, Containment, Remote Shell 11.2 Firewall Deployments, Limits, and Log Analysis 11.3 WAF Capabilities, Limits, and Rule Creation

12 SIEM and SOAR

12.1 SIEM Deployments, Parsing, and Raw Logs to Alerts 12.2 Alert Management, Threat Hunting, Triage, Reporting 12.3 SOAR Playbooks, Enrichment, and TI Integration

13 Threat Intelligence and Vulnerability Scanning

13.1 Feeds, Indicators, Classifying IPs, Domains, and Hashes 13.2 YARA and TI Integration with SIEM/SOAR 13.3 External vs Internal, Web vs Network Scanning

14 SOC Team, Activities, and Alert Triage

14.1 Blue/Red Teams, Hierarchy, and SOC Roles 14.2 Proactive vs Reactive: FP Remediation, Detection Engineering, Tabletop, DFIR, Threat Hunting 14.3 Workbooks; Ticket vs Alert vs Detection Rule 14.4 Triage Workflow, Severity, Status, and Verdicts

15 SOC Metrics, Escalation, and Communication

15.1 MTTA, MTTD, MTTR, SLA, and Lookups 15.2 Escalation Matrix, Urgent Remediation, and Cross-Team Communication

1.1 Current SAL1 Exam Facts

Key Takeaways Explain This Topic AI

TryHackMe Security Analyst Level 1 (SAL1) is an entry-level hands-on security analyst certification aimed at students, career switchers, and people with under three years of experience.

SAL1 is one professional exam with three scored parts inside a single 24-hour window: 80 multiple-choice questions (200 marks, 1 hour) plus two SOC Simulator scenarios (400 marks and 2 hours each).

The published pass mark is 750 out of 1000; the two simulators together are 800 marks, so they decide most of the result.

SAL1 is a scored professional certification, not a certificate for finishing a TryHackMe learning path.

TryHackMe does not publish an official SAL1 pass rate, and this guide does not invent one.

Last updated: September 2026

What SAL1 Is

The TryHackMe Security Analyst Level 1 (SAL1) credential is an entry-level, hands-on security analyst certification. TryHackMe positions it for people who want Security Operations Center (SOC) analyst skills: students , career switchers , and practitioners with less than three years of experience. It is not a senior detection-engineering or red-team credential. It is a first professional cert that mixes a timed knowledge paper with live investigation work.

This ExamFinch chapter is independent study material covering SAL1 exam-operations topics: who the credential is for, how the three-part exam is built, how scoring and retakes work, and how to approach the multiple-choice section. Later chapters cover the five training domains TryHackMe lists for SAL1 — from networking and operating systems through SOC workflows — and the simulator skills that carry most of the marks. ExamFinch is not a TryHackMe partner, and this guide does not claim official approval or review.

A scored professional certification

Treat SAL1 as a professional certification , not as a learning-path completion certificate. Completing TryHackMe rooms can build skills the exam tests, but finishing a path does not award SAL1. You must start a scored exam, complete three sections inside a 24-hour window, and reach 750 out of 1000 marks. Path progress is practice. The exam is the credential.

TryHackMe’s “Is SAL1 right for me?” article (checked 2026-09-19) describes a highly competitive entry-level hiring funnel and presents SAL1 as a way to demonstrate job-ready analyst skills. Use that as motivation to take the hands-on sections seriously, not as a published employment guarantee. TryHackMe also does not publish an official SAL1 pass rate. Treat any blog percentage you see as unofficial unless TryHackMe itself posts the number.

Who Should Sit SAL1

If you can already triage alerts, write a case note, and explain why an event is a true positive versus a false positive, you are in the intended audience even if you have never held a SOC title. If you are still learning what a firewall log looks like, you can still sit SAL1, but you should expect the SOC Simulator (SOC Sim) scenarios — not the multiple-choice paper — to decide the result.

Typical fit:

A student who wants a vendor-issued professional cert before applying to analyst internships or graduate SOC roles

A career switcher from IT support, networking, or help desk who already sees tickets and logs

An early-career analyst (under three years) who wants a structured, hands-on exam rather than a purely knowledge-based test

SAL1 is a poor fit if you need a specialist pentest or exploit-development credential; TryHackMe publishes other professional certifications for those paths. It is also a poor fit if you only want a badge for watching videos. The exam requires you to work alerts in a simulated SOC under time pressure, then document classification, escalation, and case-report work that TryHackMe scores separately.

Three Scored Parts in One Sitting

SAL1 is one exam with three sections . You do not book the multiple-choice paper on Monday and the labs on Friday. TryHackMe’s format article (23 Feb 2025) states that a 24-hour timer starts when you start the exam, that all three sections must be finished inside that window, and that sections must be completed in order .

• Section What you do Section time limit Marks
• Multiple-choice questions (MCQ) 80 questions on SOC fundamentals and related security concepts 1 hour 200
• SOC Simulator scenario 1 Investigate and respond to a variable number of alerts 2 hours 400
• SOC Simulator scenario 2 Second independent scenario, same rules 2 hours 400
• Exam total All three sections, in order 24-hour overall window 1000

The 1-hour and 2-hour figures are section limits. The 24-hour figure is the overall window. You cannot bank unused MCQ minutes into a simulator, and you cannot start scenario 2 before you finish scenario 1. Section 1.2 covers how the window, check-in, and delivery actually run.

Alert counts inside each simulator are variable . Do not memorise a fake “there will be 12 alerts” number. Plan for triage under time pressure with incomplete information.

SAL1 marks out of 1000

How the 1000 Marks Are Weighted

The pass mark is 750 / 1000 . That is 75% of the published total, but it is not “get 75% of the MCQ paper correct.” Marks are weighted:

• MCQ: 200 marks (20%)
• Two SOC Sims: 400 marks each (40% + 40% = 80%)

Because 800 of 1000 marks sit in the simulators, a strong knowledge paper cannot rescue two weak investigations. Arithmetic that matters on exam day:

A zero on one entire simulator leaves at most 200 + 400 = 600 marks , which is below 750 even with a perfect remaining paper. You cannot pass if one simulator section is a complete blank.

A zero on the MCQ still leaves 800 simulator marks. You would need 750 of those 800 (about 93.8% across the two sims combined). Possible in principle, but a harsh plan.

A balanced pass might look like 140/200 on the MCQ and 305/400 on each sim (140 + 305 + 305 = 750). Many other combinations work. The point is that simulator performance dominates .

Each 400-mark simulator is itself split into Classification (150) , Escalation (150) , and Case Reports (100) . Section 1.3 unpacks that split, retakes, and validity. Chapter 2 teaches how those three skills are judged inside the Analyst virtual machine.

What “hands-on” means here

“Hands-on” is not marketing filler. TryHackMe’s format article says the SOC Sim scenarios require analysing and responding to a variable number of alerts in a real-world SOC-style environment. You should expect to use investigation tools, make classification decisions, escalate when the case warrants it, and write case reports — not only pick letters on a quiz.

The MCQ still matters. It is 80 questions in 60 minutes covering SOC fundamentals, threat detection, incident response, and security concepts, with difficulty increasing as you progress (TryHackMe MCQ advice, 30 May 2025). Treat it as a fast knowledge gate, not as the main event. Section 1.4 is exam technique for that gate. It is not a dump of later domain content.

What This Guide Will and Will Not Do

This independent ExamFinch study guide will:

• Teach the logistics TryHackMe publishes (window, Onfido check-in, scoring, retakes, supported browsers)
• Teach the five training-domain topic groups and the simulator workflow in later chapters
• Give exam technique for the MCQ and for classification, escalation, and case reports

This guide will not:

• Publish a dollar price — check tryhackme.com for current pricing in your location
• Invent a pass rate
• Treat SAL1 as a completion certificate for a learning path
• Replace TryHackMe’s own candidate rules on exam day

When a Help Center article and an older access article disagree, this guide prefers the newest dated policy . Retake timing is the example you will see in section 1.3: the 20 July 2026 Retakes article supersedes the older “3 days after you started” wording.

Official Starting Points

Bookmark these before you pay or click Start:

• Purchase and overview page: tryhackme.com/certification/security-analyst-level-1
• Format and timings (23 Feb 2025): Exam Format and Timings
• Scoring (29 Mar 2025): Exam Scoring

Audience: Is SAL1 right for me?

Read those pages yourself. Policies move. This chapter’s lastUpdated date is 2026-09-19; if TryHackMe changes a number after that, the Help Center wins.