A few days ago I took and passed the ISACA CSX Practitioner (CSXP) exam. I haven’t seen any write-ups on Techexams for this, so I thought I’d share my experience.
For those who don’t know what the CSXP is, it’s a relatively new certification from ISACA that is entirely hands-on. There are no multiple choice questions to answer. You receive a virtual environment with multiple virtual machines and you have various incident response related tasks that need to be completed. This can vary from scanning for hosts on a net block and comparing the output to a list of known good hosts, to using Wireshark to detect malicious activity, and even blocking a malicious host at the firewall. You have 3.5 hours to complete the various tasks and it’s no joke.
To prepare for the exam, you really need to know your stuff. ISACA lists the various tools one should be familiar with at
https://cybersecurity.isaca.org/csx-certifications/csx-practitioner-certification#4-certification-exam . That said, if you don’t have experience with pfSense, Kali, Security Onion (including Snorby/Snort), Wireshark, and Nmap, you will probably have a hard time with the exam. It looks like ISACA also offers training in the form of a one week Bootcamp and other training, but I can’t speak to those, as I didn’t take them.
The certification itself is one of the more difficult tests I’ve taken in my career. You can’t study for this cert the week before and expect to pass. Passing this certification shows that you can walk the walk. I’ve had the opportunity to interview candidates for info sec jobs in the past 5 years and I’ve seen my share of candidates that look great on paper, but have little to no hands-on skills. You can’t braindump this cert. You have to prove your capabilities. I’m not sure I’d go as far as saying that the CSXP is the OSCP equivalent cert for Incident Response, but it’s the closest cert I’ve seen to it. I’ll definitely be putting
CSXP preferred in the job postings for my company moving forward.
