CyberWarFare Labs : Cyber Defence Analyst [CCDA] Certification — My Experience and Review

Hello everyone! I just passed the Cyber Defence Analyst [CCDA] exam from CyberWarFare Labs, so in this blog I'll share my review and insights on the course, the labs, and tips for the exam.

CyberWarFare Labs brands itself as an infosec education company providing cybersecurity training and certifications for both red teamers and blue teamers. That said, I think they really shine on the red team side: they even have their own RedCloud OS purpose-built for cloud red team assessments.

As of February 2025, they offer two blue team certifications: the Blue Team Fundamentals [BTF] and the main topic of this blog, Cyber Defence Analyst [CCDA], priced at $149.

After purchasing, you'll receive three emails: an invoice, course access credentials for their portal, and lab access credentials for their labs site. Before buying, I'd recommend reading through the course syllabus to get a clear picture of what's covered.

After purchasing, you'll get credentials to access the course at portal.cyberwarfare.live. The course covers five main topics:

• Cyber Defence roles and responsibilities
• Phishing investigation
• Web-based investigation
• Network-based investigation
• Endpoint investigation

Each module has a downloadable slide deck available from the first lesson, and every lesson is accompanied by a video. Reading the slides while watching the video works well for building a complete understanding of what the course expects you to know.

One thing worth flagging: the instructor teaches with an Indian accent, so if you're not already comfortable with it, give yourself a little time to adjust. In my case I skipped through most of the videos since I was already familiar with the underlying concepts, but the slide diagrams were genuinely well put together so I did refer back to them occasionally.

Lab access comes via a separate email with its own credentials for labs.cyberwarfare.live.

There are 21 labs in total, and you can start each one at any time. CyberWarFare Labs provides write-ups for all of them, so you'll always have a reference for how they approach each scenario.

To activate lab access, head to the lab access request page. You get a 30-day window once activated, and you'll need to download an OpenVPN config file to connect to the lab environment. The tools you'll work with are:

• TheHive: case management
• Velociraptor: endpoint monitoring
• Moloch / Arkime: network monitoring
• Wazuh: file integrity monitoring

What I really liked about the write-ups is the investigation mind map included in each one: it walks through how they approach a case from start to finish. If you're new to this kind of work, taking notes from these mind maps will genuinely help you in the exam.

There are no flags to capture; you simply follow the write-up and mark each lab as complete. Once you've finished all 21, you can share the achievement on LinkedIn.

Unlike most providers, CCDA doesn't have an on-demand exam: you need to schedule it by email. Send your request to support@cyberwarfare.live using the same email address you used to purchase the course, and include your preferred time in both UK time and your local timezone. Here's a template you can adapt:

Once they confirm your schedule, they'll send two follow-up emails in addition to the confirmation reply:

• First email: sent alongside the confirmation, containing an overview of the exam (not the full details yet) with some useful general information.
• Second email: sent shortly before the exam itself, containing the OpenVPN config file, scope of engagement, exam objectives, credentials, scenario, deliverables, and a few additional notes.

I connected via OpenVPN at my scheduled time and had no technical issues whatsoever: all tools worked smoothly. I finished the exam and submitted my report within 6 hours of connecting. The exam isn't hard; the labs prepare you thoroughly and you won't need to go hunting for extra resources.

After submitting the report, CyberWarFare Labs replied to confirm they'd received it and would follow up soon.

Since I submitted on a Saturday, I expected results sometime between the 17th and 21st of February, accounting for business days. I was right: I received the pass notification on Monday.

CyberWarFare Labs issues badges and certificates through Accredible, which wraps up the exam and review process. If you're planning to take this exam, good luck on your journey!

Thanks for reading!