How I Prepared for and Passed the TryHackMe SOC Analyst Level 1 (SAL1) Exam

What worked, what I learned and the advice I would give myself if I were preparing for the SAL1 exam again.

I have taken several technical certifications over the years, including professional-level AWS cloud certifications and cybersecurity exams, but I probably found the SAL1 exam the most enjoyable. This might sound strange considering it was also, by far, the longest exam I have taken with five hours of assessments.

For context, I have worked in quality engineering for 23 years, but I am not a career SOC analyst. I took SAL1 because I wanted to develop practical security investigation skills that I did not yet have.

What made it enjoyable was that most of the exam involved hands-on investigation work. For around 80% of it, I felt like I was actually working in a Security Operations Centre, triaging alerts, reviewing evidence and deciding whether activity was legitimate or malicious.

You are given a 24-hour window to complete the exam, which is split into three sections:

• Section 1: 80 multiple-choice questions with a one-hour time limit. This accounts for 20% of the overall score and covers areas such as networking, security tools and SOC frameworks.
• Sections 2 and 3: Two separate SOC Simulator scenarios, each with a two-hour time limit. You investigate alerts, use tools such as Splunk and the Analyst VM, distinguish false positives from true positives, and write incident reports.

With all that in mind, here is how I prepared, how I planned the exam day and the advice I would give myself if I were starting again.

Complete the Recommended Training

My first recommendation might sound obvious: Just follow TryHackMe’s own advice and complete the suggested training before attempting SAL1.

At a minimum, I would recommend completing the SOC Level 1 learning path. If you are completely new to cybersecurity, I would also suggest starting with the Pre Security and Cyber Security 101 paths.

I personally completed all three: Pre Security, Cyber Security 101 and SOC Level 1. This is one reason my preparation took several months, but it was worth the investment. Together, they gave me a strong foundation before attempting the exam.

The SOC Level 1 path covered the knowledge and investigative skills I needed. It explained the key concepts clearly, but more importantly, it gave me plenty of opportunities to apply them through practical exercises.

I would not skip any of the hands-on labs. This is where much of the learning happens and where I gained experience with the practical investigation work that makes up most of the exam.

Keep Practising After the Learning Path

My next piece of advice is practice, practice, practice. I cannot stress enough how important the hands-on work was for me. The capstone challenges, Topic Rewind Recaps and Skills Boost all gave me additional ways to apply what I had learned.

SOC Level 1 Capstone Challenges

The final module in the SOC Level 1 learning path is the SOC Level 1 Capstone Challenges.

At the time of writing, these included Tempest and the three Boogeyman challenges. Unlike the guided walkthroughs in the main learning path, these were more independent investigations where I had to work through fuller attack chains.

The challenges became progressively more difficult. They helped me improve my investigation process, practise using Splunk and become more confident deciding whether activity was suspicious or legitimate. Some took a fair amount of time to complete as the questions and investigation tasks became more challenging.

Topic Rewind Recaps

I also found the Topic Rewind Recaps useful, particularly towards the end of my preparation.

The full learning path took me several months, so some of the earlier topics were no longer as fresh by the time I reached the end. The recaps provided a short set of questions covering the main points from each module and helped me identify anything I had forgotten.

Skills Boost

I would also recommend enabling Skills Boost, as this gave me another useful way to practise.

When I struggled with questions in a Topic Rewind Recap, Skills Boost recommended an additional lab or challenge focused on that area. This allowed me to revisit weaker topics and work through them again.

Together, the capstone challenges, recaps and Skills Boost reinforced what I had learned and made me more confident applying it during an investigation.

Get Really Comfortable Investigating in Splunk

A lot of the hands-on practice in the SOC Level 1 learning path involves Splunk, so this skill develops naturally as you complete the labs. However, I found that simply knowing how to run a search was not enough.

One of the most important skills I learned was how to follow a sequence of activity. You may begin with one clue, such as a username, process, IP address or timestamp, and then use it to pivot into another search. Each result can reveal the next part of the investigation.

I also learned how important it is to choose the right fields and display the most useful information in one view. When the key events are presented clearly, it becomes much easier to scroll through the results and understand the full attack chain.

When useful details are buried in the logs and you have to keep expanding individual events, it becomes much harder to see the wider picture. Learning how to filter the results and highlight the right fields can save a significant amount of time, and in my experience, even hours.

I found it useful to practise investigating areas such as:

• Suspicious processes
• Parent-child process relationships
• User and authentication activity
• Network connections
• Command-line execution
• Indicators of compromise

You do not need to memorise every possible Splunk query. What mattered more for me was knowing how to begin an investigation, refine the search, pivot from one clue to another and bring related events together into a clear timeline.

One final tip that really accelerated my learning was watching cybersecurity professionals investigate incidents using Splunk on YouTube. Seeing how other people structured their searches, selected fields and pivoted between events helped me recognise where my own approach was inefficient.

Understand How an Attack Unfolds

Another skill that supported my Splunk investigations was understanding how an attack typically unfolds.

The SOC Level 1 learning path covers the cyberattack chain and the types of actions an attacker may take after gaining access to a system. I found it important to focus on this because it helped me understand what I was seeing in the logs rather than treating each event in isolation.

That meant recognising:

• Suspicious parent-child process relationships
• How attackers may establish persistence
• How commands or scripts may be executed
• How an attacker may move through an environment
• How data may be collected or exfiltrated

The key for me was understanding how several seemingly separate events could connect to form a wider attack sequence. This made it much easier to follow the evidence and build a clearer picture of what had happened.

Practise Using the Interactive SOC Simulator

The TryHackMe interactive SOC simulator was fundamental to my preparation, so I would not overlook it.

The simulator includes easy and medium-difficulty exercises using Splunk. I would recommend completing each one at least once, but repeating them was where I gained the most value. I completed each one three times and learned something new on every attempt.

Repeating the simulator improved my preparation in three main areas.

First, it strengthened my technical investigation process. I became faster at searching through the evidence, following the sequence of activity and deciding whether an alert was a true positive or a false positive.

Second, it improved my SOC report writing. I had to explain clearly what happened, why I classified the alert in a particular way and what actions should be taken next. I found the 5 Ws useful for structuring my report: who was involved, what happened, when it happened, where it happened and why it was significant.

Third, each attempt made me more comfortable with the overall SOC workflow. I became more efficient at reviewing tickets, reading the SOC handover notes, triaging alerts and documenting the outcome.

This repetition was particularly valuable because the practical parts of the exam use the same simulator and tooling. The attack scenarios will be different, but the way you navigate the simulator, investigate alerts and submit your findings will be familiar.

Getting comfortable with that process before the exam put me in a much stronger position.

Become Familiar With Threat Intelligence Tools

I also became comfortable using external threat intelligence tools to investigate IP addresses, domain names, URLs and file hashes.

My go-to tool throughout the training was VirusTotal, which helped me check whether an indicator had previously been associated with malicious activity.

One practical tip from my exam experience is to have an alternative available. TryHackMe provides a virtual machine with its own threat intelligence tool, but it became unavailable for me at one point during the exam. This was frustrating and added unnecessary stress, so I opened VirusTotal directly in the browser and continued my investigation.

Knowing how to use an alternative tool helped me avoid losing time. I still treated the results as supporting evidence rather than the final decision on whether an alert was malicious.

Tips for the Exam

The recommendations so far focus mainly on preparation. For the exam itself, there are two additional things that helped me.

Read the SOC Handover Notes

Before starting each practical lab, I carefully read the SOC handover notes.

They provide important context about the environment, including users, systems, IP ranges and activity already known to be legitimate. This was particularly useful when investigating false positives and helped me avoid spending time on expected activity.

Plan Your 24-Hour Exam Window

As mentioned earlier, the exam contains five hours of assessments split across one multiple-choice section and two practical labs. However, you have a 24-hour window in which to complete them.

I would not recommend attempting all five hours without a break. I planned the day around how I work best and left enough time to reset between each section.

My schedule was:

• Multiple-choice assessment: 11:00 am to 12:00 pm
• First practical lab: 2:00 pm to 4:00 pm
• Second practical lab: 5:00 pm to 7:00 pm

This worked well for me because each break gave me time to mentally reset before starting the next investigation.

Final Thoughts

The complete exam experience took around seven to eight hours of my day once the breaks were included. It felt less like sitting a traditional certification exam and more like completing a day of practical security investigation work, which is one of the main reasons I enjoyed it.

My main advice is not to rush through the preparation. Complete the hands-on labs, repeat the SOC Simulator, practise writing investigation reports and become comfortable explaining the reasoning behind your decisions.

For anyone beginning their journey into security operations, I found the SOC Level 1 learning path and SAL1 exam to be a strong and practical introduction to working as a SOC analyst.

The exam format and learning platform may change over time, so this article is based on my experience of completing SAL1 in July 2026.