- Exam Snapshot: What You're Actually Signing Up For
- The Ten ASSA80 Domains, Explained
- Registration, Fees, and Delivery Mechanics
- Building a Domain-Aware Study Plan
- Network TAPs vs. SPAN Ports: A Frequent Sticking Point
- Filtering, Threat Hunting, and File Extraction
- Question Style and What "Closed Book" Really Means
- Who Actually Sits This Exam
- Frequently Asked Questions
- ASSA80 (exam 250-552) has 65-75 questions, a 90-minute limit, and a 70% passing score.
- Broadcom recommends three months of hands-on production or lab experience before testing.
- The exam ties directly to ten BTS study guide domains, from packet capture to third-party integrations.
- Registration runs through CertMetrics and Pearson VUE, with test-center and OnVUE remote options.
Exam Snapshot: What You're Actually Signing Up For
Administration of Symantec Security Analytics 8.0, tracked under the identifier ASSA80, corresponds to Broadcom's exam 250-552 in its Broadcom Technical Specialist (BTS) program. It is a proctored, closed-book test consisting of 65-75 questions delivered in a 90-minute window. Broadcom sets the passing score at 70%, delivers the exam in English, and charges a USD 250 fee at registration. You'll also need to accept the Broadcom Software Certification Agreement before your results are finalized.
Broadcom's own exam listing recommends three months of regular production or laboratory experience with Security Analytics, along with intermediate-level networking and security knowledge. The companion study guide widens that window slightly, suggesting 3-6 months of hands-on time. If you've only read documentation and never touched a live capture, budget extra weeks before your test date.
For a full breakdown of eligibility expectations, see ASSA80 Requirements 2026: Eligibility, Prerequisites & How to Qualify. If you want the exact scoring math spelled out, read ASSA80 Passing Score 2026: Exactly What You Need to Pass.
The Ten ASSA80 Domains, Explained
Broadcom's BTS study guide organizes exam content into ten domains. Every question on the real exam maps back to one of these areas, so treat this list as your master checklist rather than a suggestion.
Domain 1: Network Visibility Through Packet Capture
Covers how Security Analytics captures traffic as it crosses the network, forming the raw evidence base for every later investigation.
- Understand capture placement and continuous full-packet retention
Domain 2: Core Architecture
Covers virtual and hardware appliance models, including how components interact in a deployed environment.
- Know the differences between appliance types and where each fits
Domain 3: Network Architecture Requirements
Covers placement decisions, including the well-known distinction between network TAPs and SPAN ports (detailed further below).
- Map traffic-visibility method to network topology
Domain 4: Deployment Configuration
Covers configuration through both the CLI and the web interface, and the key options available in each.
- Recognize which settings are CLI-only versus GUI-accessible
Domain 5: Filtering and Indicators
Covers basic and advanced filtering syntax, indicator creation, and recommended filtering best practices.
- Practice building filters that narrow large capture sets efficiently
Domain 6: File Extraction
Covers the extraction process itself, the resulting artifacts, and how those artifacts support investigations.
- Know what artifact types are produced and their evidentiary purpose
Domain 7: Cyber-Attack Anatomy and IoCs
Covers the Cyber Kill Chain stages and what constitutes an Indicator of Compromise.
- Be able to place an observed behavior at the correct kill-chain stage
Domain 8: Threat Hunting and Incident Response
Covers frameworks and procedures for proactive hunting and structured incident response.
- Connect retrospective investigation techniques to hunting workflows
Domain 9: Reporting
Covers creating, using, and distributing reports generated within Security Analytics.
- Know report scheduling and distribution mechanics
Domain 10: Integrations
Covers how Security Analytics connects with both Symantec and third-party security products.
- Identify integration points that extend detection and response workflows
For an extended walkthrough of each objective with more granular sub-topics, see ASSA80 Exam Domains 2026: Complete Guide to All 10 Content Areas.
Registration, Fees, and Delivery Mechanics
Registration for exam 250-552 runs through CertMetrics, which hands off scheduling to Pearson VUE. You have two delivery choices: an in-person test center or OnVUE remote proctoring from your own workstation. Either way, the test is closed book - no notes, reference material, or external documentation during the session.
The fee is USD 250. Once you pass, your Broadcom Technical Specialist credential is valid for two years. Recertification requires passing an available Broadcom Software exam version at the time your credential expires - there isn't a separate "renewal-only" track, so plan to sit a current exam again.
For the complete cost breakdown, including what the fee does and doesn't cover, see ASSA80 Certification Cost 2026: Complete Pricing Breakdown. If you're weighing scheduling logistics against other commitments, check ASSA80 Exam Dates 2026: Testing Windows, Deadlines & Scheduling before you lock a slot.
Building a Domain-Aware Study Plan
Rather than generic study advice, sequence your preparation around domain weight and dependency. Architecture and deployment concepts (Domains 2-4) form the foundation that filtering, extraction, and hunting (Domains 5-8) build on. Reporting and integrations (Domains 9-10) tie everything together and are easiest to absorb last, once you understand what data is being reported on.
Foundations
- Study Domain 1 (packet capture) and Domain 2 (core architecture)
- Review virtual vs. hardware appliance differences
Network Placement and Deployment
- Work through Domain 3 (TAP vs. SPAN) and Domain 4 (CLI/web configuration)
- Practice locating each configuration option in both interfaces
Investigation Skills
- Focus on Domain 5 (filtering, indicators) and Domain 6 (file extraction)
- Build sample filters and trace extracted artifacts end to end
Analysis and Output
- Cover Domain 7 (kill chain/IoCs) and Domain 8 (threat hunting frameworks)
- Finish with Domain 9 (reporting) and Domain 10 (integrations)
- Run a full practice test under the 90-minute limit
If you'd rather see the entire study path condensed into one reference, bookmark ASSA80 Cheat Sheet 2026: One-Page Review of Must-Know Facts for last-week review.
Network TAPs vs. SPAN Ports: A Frequent Sticking Point
Domain 3 asks candidates to describe Security Analytics network architecture requirements, specifically the differences between network TAPs and SPAN ports. This distinction shows up repeatedly in scenario-based questions because it directly affects capture fidelity.
| Aspect | Network TAP | SPAN Port |
|---|---|---|
| Traffic delivery | Passive, dedicated hardware copy of full-duplex traffic | Switch-generated mirrored copy, sharing switch resources |
| Risk of drops | Lower, since it doesn't compete with switch CPU load | Higher under heavy traffic, since switch resources are shared |
| Deployment impact | Requires physical inline hardware placement | Configured in software on existing switch |
| Typical use in Security Analytics | Preferred for high-fidelity, continuous capture | Acceptable for lower-volume or budget-constrained segments |
Expect exam questions to present a network scenario and ask you to identify which capture method is appropriate, or to explain why one might drop packets under load while the other does not.
Filtering, Threat Hunting, and File Extraction
Three domains - filtering (5), file extraction (6), and threat hunting (8) - form the practical core of day-to-day Security Analytics administration, and they're heavily represented in scenario questions.
- Basic and advanced filtering: You should be comfortable narrowing large capture datasets using both simple field filters and layered advanced filters, and know when creating a saved indicator is more efficient than rebuilding a filter from scratch.
- File extraction artifacts: Understand what gets pulled out of a capture during extraction and how each artifact type supports downstream analysis or evidence preservation.
- Retrospective investigations: Because Security Analytics retains historical captures, expect questions on how to go back in time to a suspected incident window and reconstruct activity.
- Threat hunting procedures: Tie filtering and extraction skills to structured hunting frameworks and incident response steps rather than treating them as isolated tools.
Key Takeaway
Don't study filtering and file extraction as separate topics - nearly every retrospective investigation scenario on the exam combines both, then asks you to connect findings to a Cyber Kill Chain stage.
Question Style and What "Closed Book" Really Means
Broadcom's official sample materials for 250-552 include both single-answer and multiple-response question formats. Multiple-response items typically require you to select more than one correct option, so read instructions carefully - partial selection usually doesn't earn credit.
Because the exam is closed book, you cannot bring notes, reference guides, or external documentation into the test session, whether at a physical test center or via OnVUE remote proctoring. This makes memorizing interface locations, CLI option names, and terminology genuinely necessary rather than optional. Reviewing screenshots of the web interface and CLI syntax during study is far more useful here than for open-book exams.
If you're trying to gauge how challenging this actually feels in practice, How Hard Is the ASSA80 Exam? Complete Difficulty Guide 2026 compares question style against the 70% passing threshold. For broader context on outcomes, see ASSA80 Pass Rate 2026: What the Data Shows.
Who Actually Sits This Exam
ASSA80 is aimed at administrators and security analysts who work directly with Security Analytics appliances - people responsible for deployment, ongoing filtering rules, extraction workflows, and reporting to stakeholders. It's also relevant to incident response and threat hunting staff who need to pull retrospective evidence from captured traffic during an active investigation.
Because Domain 10 covers integrations with both Symantec and third-party security products, teams running Security Analytics alongside a broader SOC toolchain - SIEMs, endpoint detection platforms, ticketing systems - will find that section directly applicable to real deployments, not just exam trivia.
If you're mapping this credential against career direction, see ASSA80 Jobs and Is the ASSA80 Certification Worth It? Complete ROI Analysis 2026. For training resources aligned to the current recommended courseware, check ASSA80 Training.
New to the credential entirely? Start with What Is ASSA80? and ASSA80 Certification for a plain-language overview before diving into domain-level study. You can also revisit this guide anytime at ASSA80 Study Guide 2026: How to Pass on Your First Attempt.
Frequently Asked Questions
Broadcom's official exam listing specifies 65-75 questions, delivered within a 90-minute time limit.
The passing score is 70%. The exam is delivered in English and is closed book at both test centers and via OnVUE remote proctoring.
Broadcom's exam page recommends three months of regular production or lab experience with intermediate networking and security knowledge; the study guide suggests 3-6 months.
The exam retains its original 8.0 title and the study guide cites 8.0.x documentation, while Broadcom's current training recommendation points to Security Analytics 8.2.5 Administration coursework. Study to the ten objectives, not the version number.
No. November 1, 2030 marks the end of maintenance and technical support for Security Analytics as a product - it is a lifecycle notice, not an announcement about exam retirement.