EEDA Exam Guide: Hands-On Defense Lab Prep and 8-Week Plan

The INE Enterprise Defense Administrator (EEDA) is a hands-on, lab-based defensive security exam. You are tested on practical work, not on a pile of multiple-choice questions. Our voucher costs $234.99 (USD, as listed on 2026-11-04).

Below you get who the exam fits, how to prepare week by week, a log drill with commands, and our voucher terms.

Who the EEDA fits and who should skip it

EEDA is a practical test of defensive skills. You apply what you know in a lab, so defining terms is not enough.

It is a good fit if you:

• Want a defender-side credential with a practical exam.

• Work in, or want to move into, a SOC, blue team, or security engineering role.

• Learn better by doing labs than by reading.

It is a weaker fit if you want a policy-heavy credential. EEDA is a technical, hands-on defense exam, not a governance, risk and compliance (GRC) credential. Pick something else if audits and policy writing are your goal.

If you want to compare it with an attacker-side exam, our ECPPTV2 exam guide covers a hands-on exam from the other direction. Many people take one of each to see the same network from both views.

Exam facts and what to confirm with INE

The exact role title, lab environment, time limit, passing score, retake rules and voucher validity are on INE's official EEDA exam page. Check them there before you book, because these details can change.

The key point is the style. In a lab exam, you cannot guess your way through. You find the issue, fix or contain it, and document it, or you do not.

Cost, delivery and refund terms

Our price for the EEDA Enterprise Defense Administrator voucher is $234.99, in USD, as listed on 2026-11-04. Before buying, read INE's voucher and retake terms so you know what one purchase covers.

Budget for more than the voucher. Practice time is the real cost, so plan for lab hours, a quiet block of time on exam day, and a possible retake.

Delivery and refunds

• The voucher code is emailed within 12 hours of payment. It also appears in your account.

• You can cancel an order for a full refund before delivery.

• A delivered code is non-refundable unless the test provider rejects it as invalid, already used, or expired on first use.

• In that case, contact support within 14 days with your order number and a screenshot. We replace or refund the code.

Full details are on our refund policy and delivery policy pages.

Skills to practice before exam day

Use INE's official topic list as your master checklist. For a defensive, enterprise-network lab, these skill areas are commonly useful:

Beginners should allow extra weeks for networking, Linux and Windows basics before starting lab work. Weak fundamentals slow every task in a practical exam.

A worked practice drill

Build a small home lab with one Linux and one Windows virtual machine. Then run a 45-minute drill: cause some noise, then find it in the logs.

1. On Linux, try a few wrong SSH passwords against your own test VM.

2. Find the failures and write down the time, source IP and user.

3. List listening services and decide which ones should not be there.

4. On Windows, find failed logons and new processes in the Security log.

5. Write three lines: what happened, how you know, what you would change.

Useful commands for your own lab:

journalctl -u ssh --since "1 hour ago" | grep -i "failed"
ss -tulpn
sudo grep "Failed password" /var/log/auth.log

The SSH service unit is ssh on Debian and Ubuntu but sshd on some other distributions, so use journalctl -u sshd there. The file /var/log/auth.log exists on Debian and Ubuntu. On RHEL-family systems, look in /var/log/secure instead.

On Windows, filter the Security log for event ID 4625 (failed logon) and 4688 (new process, if process auditing is on). Only run these drills on systems you own.

An 8-week study plan

This plan assumes about 6 to 8 hours a week. If you work in security already, compress it to four weeks. If you are new, stretch it to twelve.

Keep a running notes file with the commands that worked. In a lab exam, quick recall of your own tested commands saves time.

Common mistakes to avoid

• Reading instead of doing. Watching videos feels productive, but the exam rewards typing commands.

• Skipping documentation. Notes help you retrace steps and avoid repeating work under time pressure.

• Ignoring the basics. Weak networking and OS knowledge slows every task.

• Going in without a timed run. Do at least one full practice session with a clock.

• Changing things without recording them. In a defensive lab, you need to know what you altered.

• Booking too early. Book only when your practice labs feel routine.

After you pass

Update your resume and LinkedIn with the exact credential name, Enterprise Defense Administrator (EEDA). Then be ready to describe a lab you completed, because interviewers for defensive roles often ask for specifics.

A sensible next step is to deepen one area, such as detection or incident response. You can browse more options in our Cybersecurity certification category.

Sources

• EEDA Enterprise Defense Administrator voucher (INE)

• Refund policy

• Delivery policy