BTL1 performance-based questions: what they are and how to practise them

BTL1 has no multiple choice at all. The exam is a multi-day practical window in which you carry out investigations across phishing, SIEM, forensics and incident response, and typically write at least one incident report. It is open-book and open-internet, graded by Security Blue Team rather than watched by a proctor. Whether you can run an investigation and communicate the result. Knowing the answer is only half of it: BTL1 assesses whether you can document what you found in a form somebody else can act on.

Security Blue Team BTL1 practice questions · All certifications · Start with 25 free questions