BTL1 if you want to prove you can do the work, CySA+ if you need a credential recruiters and compliance frameworks already recognise. The exams test genuinely different things, and the format difference is the largest of any pair here.
Both target the blue-team analyst: phishing analysis, SIEM work, incident response, forensics. The knowledge domains largely correspond — the assessment method does not.
BTL1 is a practical exam, not multiple choiceBTL1 is a 24-hour practical incident-response assessment from Centri, formerly Security Blue Team. Candidates investigate a lab environment and receive immediate grading and feedback. The current course includes one free resit. Our short exercises support the underlying skills; they do not reproduce the practical exam.
CySA+ is a proctored, timed examCySA+ is a single 165-minute sitting of up to 85 questions, with performance-based questions embedded but no multi-day investigation. It measures whether you reach the right conclusion quickly, not whether you can carry out and document a full investigation.
BTL1 covers ground CySA+ does notCentri publishes six BTL1 domains — security fundamentals, phishing analysis, threat intelligence, digital forensics, SIEM and incident response — and teaches phishing analysis, forensics and threat intelligence as subjects in their own right. CySA+ folds several of these into broader domains.
Recognition differs by audienceCySA+ appears in job specifications and compliance frameworks; BTL1 carries more weight with practitioners assessing whether you can actually investigate. Which matters more depends on who is reading your CV.
Which order
Taking them in sequence
Neither is a prerequisite for the other. Candidates who want a hiring credential usually take CySA+ first; those who already have a role and want to prove practical capability often prefer BTL1. Confirm BTL1 pass thresholds and retake terms on the official Centri page before booking, as these change periodically.
Exam costs and practical preparation
The exam provider charges for certification. CertSprint is independent practice; its question-bank price does not include an official exam voucher, provider training or a lab subscription.
Provider fees and scope links · pricing snapshot 18 October 2026
Decision
BTL1
CySA+
Official exam and timing
BTL1. 20 task-based questions answered from evidence you find in a compromised corporate lab. 24 hours of in-browser lab access, started whenever you feel ready.
CS0-004. Up to 85 questions. 165 minutes.
Provider cost
Centri lists £399 GBP for training and the exam, including one free resit voucher. Confirm the current package before purchase. Provider pricing and terms
An exam voucher is purchased separately. Check the current CompTIA price for your country and booked version. Provider pricing and terms
Scope to check
Security fundamentals, phishing analysis, threat intelligence, digital forensics, SIEM and incident response. Official scope
Use the CS0-004 exam objectives for CS0-004 preparation; do not substitute the older CS0-003 weighting. Official scope
Practical preparation
Investigate evidence in a hands-on lab. Multiple-choice practice cannot reproduce the practical exam.
Interpret alerts, vulnerability evidence and response decisions across different security products.
Try three questions. Understand every answer.
Original English practice examples, with answers and explanations available here. No account required. These are independent teaching examples, not official exam questions or exam dumps.
BTL1 is a practical investigation exam. These multiple-choice examples rehearse analytical decisions; they do not reproduce its hands-on exam format.
Question 1 of 3 · BTL1 · Phishing and security operations
Answer and explanation
Best answer: Integrity is unverified and the mismatch needs investigation
The mismatch means this copy has not passed integrity verification. Preserve the acquisition record and investigate the transfer or obtain a verified copy before relying on it.
Why the other choices fit less well
Names and sizes can remain unchanged when bytes differ. Silently replacing the acquisition hash conceals the discrepancy and undermines the evidence record.
Question 2 of 3 · CySA+ · Security monitoring and threat detection
Answer and explanation
Best answer: Correlate process ancestry, arguments, connections, and surrounding events
A legitimate signed utility can be abused. The unusual execution context and network behavior justify a focused investigation, but still need corroboration before a final conclusion.
Why the other choices fit less well
A signature alone does not prove benign use. Blocking one destination and closing the case loses scope and execution context; common tool usage does not invalidate the observed evidence.
Best answer: Preserve the message and inspect headers and destinations in the approved analysis environment
Preserve the original message and inspect the actual addressing and destinations safely. The discrepancies support investigation without requiring a risky visit from a normal workstation.
Why the other choices fit less well
A display name is not proof of origin. Opening the link on production exposes the user. Mass forwarding spreads potentially harmful content and can alter the evidence context.
Paid question-bank access is a one-time purchase, with no recurring subscription. Official exam registration, vouchers and provider labs are separate from CertSprint practice.
Two exams that could hardly be more different
BTL1 is a 24-hour practical incident-response exam. You start it when you choose, investigate a compromised corporate lab in the browser, and answer 20 task-based questions from the evidence you find. It is open book and unproctored: course material, your own notes and search engines are allowed, AI assistants are not. The pass mark is 70%, which earns the silver challenge coin; 90% on a first attempt earns the gold one. The course and exam are sold together for £399, with one free resit voucher included and further resits available to buy. Centri, formerly Security Blue Team, publishes no entry requirements and aims the course at people with zero to two years of experience in entry-level or junior roles.
CySA+ CS0-003 is a proctored sitting of up to 85 questions in 165 minutes, mixing multiple choice with performance-based questions, passed at 750 on a 100–900 scale. CompTIA recommends Network+ or Security+ knowledge and a minimum of four years of hands-on SOC or incident-response experience. The English CS0-003 exam retires on 22 December 2026 and its successor CS0-004, available since 23 June 2026, keeps the same question ceiling, duration and pass mark with reweighted domains.
What the two outlines cover
Centri’s BTL1 course has six content domains before its exam-preparation section: security fundamentals, phishing analysis, threat intelligence, digital forensics, security information and event monitoring, and incident response. Three of those, phishing analysis, threat intelligence and digital forensics, are taught as subjects in their own right, each with its own tooling and lab work.
CySA+ has four domains. In CS0-003 they are weighted Security Operations 33%, Vulnerability Management 30%, Incident Response and Management 20%, and Reporting and Communication 17%; in CS0-004 the weights become 34%, 26%, 24% and 16%. Vulnerability management, close to a third of CySA+, has no counterpart in the BTL1 outline, and reporting is a scored CySA+ domain where BTL1 treats documentation as part of the investigation rather than a separate subject. The reverse gap is forensics and phishing analysis, which CySA+ touches inside broader domains and BTL1 teaches in depth.
What a pass actually demonstrates
A BTL1 pass shows you carried out an investigation: you found the evidence in the lab, drew conclusions from it and documented them, under a long time limit that rewards thoroughness over speed. Because it is open book, it does not show recall; because it is unproctored, it relies on the integrity of the candidate and the design of the lab. Practitioners tend to read it as evidence of ability to do the work.
A CySA+ pass shows you reached correct conclusions quickly and without resources, across a broader syllabus than BTL1, under proctoring. It does not show that you can run an investigation end to end, because no 165-minute exam can. Recruiters and compliance frameworks tend to read it as a recognised credential. Those are different claims, and the right one depends on who will be reading your CV.
Cost, retakes and renewal
BTL1’s £399 includes the training course, roughly 30 hours of material by Centri’s estimate, the exam and one free resit. CySA+ is priced as an exam voucher with training sold separately by CompTIA and third parties; a first retake is allowed immediately after a failed attempt and a 14-day wait applies before a third, each at the voucher price. CompTIA certifications are maintained under its continuing-education programme with its own requirements and fees. Check both providers’ current prices and renewal terms before you budget: the original comparison text quotes figures published on 5 October 2026, while the provider-fee table carries its own review date.
Deciding, in practice
Take BTL1 if you are at the start of your career, want hands-on skill you can describe in an interview, and can afford a single purchase that includes the training. Take CySA+ if the roles you are applying for list it, if you already have the experience it recommends, or if you need a credential that HR systems and compliance baselines recognise. Take both if you are building a blue-team CV from scratch: CySA+ to get the interview, BTL1 to have something concrete to talk about in it.
Order matters less than readiness. BTL1 has no prerequisites and its course teaches what the exam tests, so it can come first at any career stage. CySA+ recommends four years of experience; sitting it earlier is allowed but the exam is written for someone who has done the job.
Common questions
Frequently asked
Is BTL1 harder than CySA+?
They are hard in different ways. BTL1 is a 24-hour open-book investigation with 20 task-based questions and a 70% pass mark, so the difficulty is doing the work thoroughly. CySA+ is up to 85 questions in 165 minutes under proctoring with no resources, so the difficulty is speed and recall across four domains. Neither pass rate is published by its provider.
Does BTL1 count as a certification for job applications?
It is a certification, issued by Centri (formerly Security Blue Team) on passing the practical exam. Whether a given employer recognises it depends on the employer: it is better known among practitioners and in blue-team communities than in generic HR keyword filters, where CompTIA names appear more often.
Can I take BTL1 without any experience?
Yes. Centri states there are no entry requirements and the course is aimed at people with zero to two years of experience. The included course is designed to teach the material the exam tests.
Sources
The main comparison text and its sources were checked on 5 October 2026. The provider-fee table above has its own review date.
