Cohesity COH350 Security Specialist Study Guide

What Does the Cohesity COH350 Exam Cover?

Cohesity COH350, the Security Specialist certification, is a 60-question, 90-minute exam requiring 60 percent to pass, priced at $200 USD. It covers seven weighted domains led by System Hardening (22%), User and Access Management (17%), and Network Security (15%).

Seven domains across 60 questions means several carry only six to eight questions each, so breadth beats depth. At a 60 percent threshold you can afford 24 wrong answers, which is forgiving — but a domain skipped entirely still costs more than the margin comfortably allows.

Ninety seconds per question suits an exam that describes a security requirement and asks which configuration or feature satisfies it. Cohesity’s product documentation is the authoritative reference throughout.

Why Is Backup Infrastructure a Primary Target?

Ransomware economics changed backup security. If an organisation can restore cleanly, it does not pay — so attackers now target backup infrastructure first, and a compromised backup estate turns a recoverable incident into an existential one.

The attack pattern the exam assumes is deliberate: gain access, locate the backup infrastructure, delete or encrypt the backups or corrupt the retention policies, and only then encrypt production. By the time the production impact is visible, recovery is already gone.

That sequence explains the exam’s emphasis. Immutability prevents backups being altered even by an administrator account. Multi-factor authentication and quorum controls prevent a single compromised credential from destroying retention. Monitoring exists to detect the reconnaissance phase before the destructive one.

The other consequence is that backup data is a concentrated target in its own right. It contains a copy of essentially everything the organisation holds, which makes the backup estate one of the highest-value data stores to exfiltrate — a point worth carrying into questions about encryption and access control.

System Hardening Is 22% — What Should You Prioritise?

System Hardening is the largest domain, covering WORM storage, encryption, attack surface reduction, and system access security. Prioritise immutability and encryption — they carry the most questions and underpin the incident response domain too.

Attack surface reduction follows standard hardening logic applied to a backup platform: disable unnecessary services and protocols, restrict management interface access to defined networks, and remove default or unused accounts. The examinable framing is that every enabled service is a potential entry point into the system holding your recovery capability.

Encryption is examined in both states. Data at rest protects backups if underlying storage is accessed directly; data in flight protects backups traversing the network from source to backup infrastructure. Both are needed, and knowing which one a described exposure calls for is a recurring question type.

System access security covers administrative interface protection — network restriction, session controls, and separation between administrative and general access. The principle running through the domain is that the backup platform deserves stricter controls than the systems it protects, because it holds the recovery path for all of them.

A useful mental test for this domain: for any control, ask what an attacker who has already gained administrative credentials could still not do. Controls that fail that test are not protecting against the threat model the exam assumes.

How Does WORM Storage Actually Protect Backups?

WORM — write once, read many — is the immutability mechanism and the single most important concept in the exam. Data written under a WORM policy cannot be modified or deleted until its retention period expires, regardless of who attempts it.

The critical property is that immutability holds against administrative accounts. Conventional access control assumes an administrator is trusted; ransomware operators specifically seek administrative credentials precisely because that assumption then works in their favour. Immutability breaks it — the platform itself refuses the deletion.

Retention lock configuration is where the examinable detail sits. A retention period that can be shortened by an administrator provides no protection, because that is the first thing an attacker would do. The protective configuration is one where retention can be extended but never reduced within the locked window.

Understand also what immutability does not do. It prevents alteration and deletion; it does not prevent an attacker reading backup data, and it does not help if backups were already compromised before being written. Immutability protects recoverability, not confidentiality, and questions test whether you know the difference.

The related concept is legal hold, which preserves data beyond normal retention for litigation or investigation. It uses the same underlying mechanism for a different purpose, and it appears in the security assessment domain alongside compliance requirements.

What Does User and Access Management Require?

User and Access Management is worth 17 percent, covering multi-factor authentication, single sign-on, role-based access control, Active Directory integration, multitenancy security, and quorum groups. Quorum is the distinctive topic.

Quorum groups require multiple administrators to approve a sensitive action before it executes. Applied to operations such as deleting backups, reducing retention, or disabling security controls, this means a single compromised administrative account cannot destroy the recovery estate alone — the platform demands a second, independent approval.

That control directly addresses the primary attack path, which is why it is examined heavily. Whenever a scenario describes protecting against a compromised or malicious administrator, quorum approval is a likely part of the correct answer.

Multi-factor authentication and SSO are the more conventional controls, tested through configuration and appropriateness. Know that SSO centralises authentication — convenient and consistent, but concentrating risk in the identity provider — and that MFA on administrative access to backup infrastructure is close to non-negotiable given the target it represents.

RBAC applies least privilege to backup operations. The examinable distinction is between roles that can perform backup and restore operations and roles that can change policy or delete data — an operator who restores files daily does not need the ability to alter retention, and conflating them is the misconfiguration questions describe.

Multitenancy security matters for service providers and large enterprises, ensuring one tenant cannot access another’s data or configuration. Understand that tenant isolation must hold at data, management, and audit levels.

How Is Network Security and In-Flight Data Examined?

Network Security is worth 15 percent, covering protocol access control and securing in-flight backup data. It addresses the paths data and management traffic take across the network.

Protocol access control means restricting which protocols are available and from where. A backup platform typically supports several access protocols, and each enabled protocol on each reachable interface is an exposure. The hardening principle is to enable only what is used and restrict each to the networks that legitimately need it.

Network segmentation is the architectural control. Backup infrastructure placed on a segmented management network, unreachable from general user networks, means an attacker who compromises a workstation cannot reach the backup platform directly — which frustrates the reconnaissance phase before it starts.

In-flight encryption protects backup data traversing the network between source systems and backup infrastructure. Without it, backup traffic is a stream of the organisation’s entire data estate crossing the network in a readable form, which is a substantial exposure that questions describe indirectly.

Management traffic deserves separate consideration from data traffic. Administrative sessions carry credentials and configuration changes, so isolating management traffic from backup data traffic is a defensible design that the exam favours.

Which Assessment and Compliance Concepts Are Tested?

Security Assessment is worth 13 percent, covering compliance, legal holds, data retention, attack protection, Zero Trust design, third-party solutions, and Clean Room requirements. It is the most conceptually broad domain.

Zero Trust is the architectural principle named explicitly. Applied to backup infrastructure it means no implicit trust based on network location — every access request is authenticated and authorised regardless of where it originates, and administrative access is verified rather than assumed. The formal model is set out in NIST SP 800-207.

Retention and compliance connect technical configuration to regulatory obligation. Retention periods are frequently mandated rather than chosen, and the examinable point is that retention policy is a compliance decision implemented technically — not an operational preference.

Legal hold sits alongside it, preserving specific data beyond normal retention for litigation. Know that a legal hold must override normal expiry, and that releasing it prematurely can carry legal consequence independent of any security impact.

Third-party integration covers connecting the backup platform to SIEM, identity providers, and security tooling. The reasoning the exam wants is that backup security events belong in the organisation’s central monitoring rather than in an isolated console nobody watches — frameworks such as the NIST Cybersecurity Framework supply the governance vocabulary.

What Is a Clean Room and Why Does It Matter?

Incident Response and Remediation is worth 13 percent, covering incident recovery and Clean Room cyber event response. The Clean Room concept is named in two separate domains, which signals its importance.

A Clean Room is an isolated environment where backup data can be examined and recovered without risk of reinfecting production. Its purpose addresses the central problem of ransomware recovery: you do not know which backup is clean, and restoring an infected backup directly into production restarts the incident.

The examinable sequence is recover into isolation, validate, then promote. Recovering into a Clean Room lets you scan and verify a candidate restore point before anything touches production, which is what turns a hopeful restore into a controlled one.

Restore point selection is the associated judgement. The most recent backup is the most convenient and the most likely to be compromised, since attackers commonly dwell in an environment for weeks before triggering encryption. Identifying the last known-good point requires knowing when the compromise began, which is why the monitoring and audit domain feeds directly into this one.

Recovery planning rounds out the domain. Recovery time and recovery point objectives, prioritisation of which systems return first, and the practical reality that a full restore takes time all shape the plan — and a plan never tested is an assumption rather than a capability. Cohesity’s broader data security positioning is described on the Cohesity platform site.

How Are Monitoring, Alerting, and Auditing Covered?

Periodic Monitoring, Alerting and Auditing is worth 10 percent, covering audit logging, remote syslog, ransomware and breach monitoring, and alert notifications. Secure Data Management adds a further 10 percent on data isolation methods.

Remote syslog forwarding is the most examinable configuration detail, for a specific reason: logs held only on the backup appliance can be deleted by an attacker who compromises it. Forwarding to an independent syslog server preserves the evidence of what happened even if the platform itself is compromised.

Anomaly-based ransomware detection is the platform-specific capability. Encryption of large volumes of data produces characteristic changes in data patterns and change rates, and detecting that shift can surface an attack in progress rather than after the fact. Its practical value is narrowing when the compromise began, which directly informs restore point selection.

Alert configuration follows the familiar discipline. Alerts must reach someone who will act, and thresholds set too sensitively produce volume that trains recipients to ignore them — the same alert fatigue problem that afflicts every monitoring domain.

Data isolation, covering the final 10 percent, is the architectural control of last resort. Maintaining a copy of backup data separated from the primary environment — logically, physically, or both — means a compromise of the main estate does not necessarily reach the isolated copy. It is the modern form of the air gap, and it is what makes recovery possible in the worst case.

How Should You Prepare for COH350?

Five to seven weeks at five to six hours per week suits engineers with Cohesity experience. Effective COH350 preparation weights time toward hardening and access management while ensuring the smaller domains are covered rather than skipped.

Platform familiarity is assumed rather than taught. Engineers who have worked through the COH125 implementation professional path will already have the deployment grounding this exam builds on, and can concentrate entirely on the security layer.

1. Weeks one to two — system hardening. The 22 percent domain. Configure WORM and retention lock, then attempt to delete protected data as an administrator so the immutability guarantee is concrete rather than theoretical.
2. Week three — access management. Configure MFA, SSO, and RBAC roles, then set up a quorum group and walk a sensitive operation through its approval flow.
3. Week four — network and data management. Work through protocol restriction, segmentation, and in-flight encryption, then study data isolation approaches.
4. Week five — assessment and incident response. Study Zero Trust applied to backup, retention and legal hold, then the Clean Room recovery sequence end to end.
5. Weeks six to seven — monitoring and review. Configure remote syslog and anomaly alerting, then move to timed practice across all seven domains.

The habit that pays off most is asking what a compromised administrator could still not do. That question is the design logic behind immutability, quorum approval, remote syslog, and data isolation alike — and once you see the pattern, a large share of the exam becomes predictable. Timed work through the COH350 practice exam questions confirms whether your coverage matches the weightings, and the Zero Trust definition is worth reading in its formal form.

Frequently Asked Questions

How many questions are on the COH350 exam?

The exam contains 60 questions to be completed in 90 minutes, allowing roughly 90 seconds per question. The pace suits its scenario-based configuration questions.

What is the passing score for COH350?

You need 60 percent, which means 36 of the 60 questions correct. That is relatively forgiving, but seven domains means a skipped area still costs more than the margin comfortably allows.

How much does the Cohesity Security Specialist exam cost?

The exam fee is $200 USD. Cohesity provides training materials through its education portal for candidates preparing independently.

Which domain carries the most weight?

System Hardening at 22 percent, covering WORM storage, encryption, attack surface reduction, and system access security. User and Access Management follows at 17 percent.

What does WORM storage protect against?

Modification or deletion of backup data before its retention period expires — including by administrative accounts. That last point matters because ransomware operators specifically target administrative credentials.

What is a quorum group?

A control requiring multiple administrators to approve a sensitive operation such as deleting backups or reducing retention. It means a single compromised account cannot destroy the recovery estate alone.

What is a Clean Room in cyber recovery?

An isolated environment where backup data is recovered and validated before being promoted to production, so a compromised restore point cannot reinfect the environment during recovery.

Why should audit logs be forwarded to a remote syslog server?

Because logs held only on the backup appliance can be deleted by an attacker who compromises it. Forwarding preserves the evidence independently of the system being investigated.

Why is the most recent backup not always the right restore point?

Attackers frequently dwell in an environment for weeks before triggering encryption, so recent backups may already be compromised. Identifying the last known-good point requires knowing when the intrusion began.

How long should I study for COH350?

Five to seven weeks at five to six hours per week suits engineers with Cohesity experience. Weight the time toward system hardening and access management, which together carry 39 percent.

Conclusion

COH350 reflects a genuine shift in how backup infrastructure is treated. Its weightings put hardening and access management first because the recovery estate is now a primary target, and an attacker who reaches it turns a recoverable incident into an unrecoverable one.

One question unlocks most of the exam: what could a compromised administrator still not do? Immutability, quorum approval, remote syslog forwarding, and data isolation are all answers to it, and recognising that shared logic makes the correct option far easier to spot.

Prepare hands-on where you can. Configure retention lock and then try to delete the data. Set up a quorum group and walk an approval through. Those two exercises teach the exam’s central premise faster than any amount of reading about it.