Foundational Incident Response (IR-200) FAQ

  • Updated
Follow

In this article, you will find answers to the following questions:

How can I get access to IR-200?

To access the IR-200 course, you can do so through the following options:

Note: 30-day lab extensions are only available for learners who purchase IR-200 through the Course & Cert Exam bundle. Learn subscribers can extend access by renewing their subscription.

Where can I find the IR-200 course syllabus?

You can access the IR-200 course syllabus here.

Can I download the course material?

Absolutely! Please see below for the following products where you can download the Course materials:

Course and Cert Bundle: Yes, if you selected IR-200 as your main course you may download a version of the course materials once while the access is active.
Learn One Subscription: Yes, if you selected IR-200 as your main course you may download a version of the course materials once during the subscription period.
Learn Unlimited Subscription: Yes, you can download course materials up to three (3) courses of your choosing once during the subscription period.
Learn Enterprise Subscription: No, all content/courses for this subscription does not include downloadable versions.

Important: At OffSec, we are committed to providing you with the most up-to-date learning resources. Please note that the IR-200 PDF materials are up to date and available for download. However, the video content is not yet available at this time.

As part of our continuous improvement process, our online content is updated regularly to ensure the best learning experience. However, there is no set timeline for when updates will be included. To stay informed, we recommend joining our Discord community, where you can keep tabs on the course channels and be notified of any new developments.

I do not have time to dedicate to my studies now, can I pause my course access?

Once the access to the course has started, the access to the course content will run in a consecutive block of time which cannot be paused for any reason.

Which certification exam is associated with the IR-200 course?

The certification exam associated with the IR-200 course is the Offensive Security Incident Responder (OSIR) exam. Successfully passing this exam demonstrates expertise in detecting, mitigating, investigating, and recovering from cybersecurity incidents while ensuring compliance and effective coordination.

What is the validity of an OSIR exam attempt?

For exam attempts as part of the Course & Cert Exam bundle, it will remain valid within 120 days from the lab end date.

If it’s part of Learn One or Learn Unlimited subscriptions, the exam attempt remains valid while the subscription is active.

For additional information, please visit this page.

Is there a cooling off period between exams?

Yes. For detailed information, please refer to the What is the Exam Retake Policy? article.

How do I get CPE points for IR-200?

If you have successfully passed the OSIR exam, you may be eligible to earn CPE points, which you will need to submit directly through the ISC² member portal.

If you have not taken or passed the exam, you can still earn CPE points by submitting solutions with at least 80% accuracy for each topic lab in your portal. Once completed, you can request a formal completion letter by emailing orders@offsec.com.

For additional information and instructions, please visit this page.

Does my OSIR certification expire?

Yes, the OSIR certification expires after 3 years.

To maintain the validity of your certification consider one of the following renewal options before the expiration date:

Please note that if your certification expires, you will need to retake and pass the same certification exam.

Relevant Resources

You may also visit the website for additional information.

 

Related articles

Powered by Zendesk