围绕考试实际考察的判断力设计的 BTL1 练习题。

Blue Team Level 1 是什么，适合谁考

Blue Team Level 1, almost always written BTL1, is a defensive-security certification from Centri — the company that published it as Security Blue Team, whose securityblue.team address now redirects to centri.org. It is sold as one package rather than as a bare exam: an on-demand course plus a single practical exam.

Centri aims it at entry-level and junior roles, and names the people it has in mind: students, IT staff moving sideways into security, and anyone heading for a first job as a SOC analyst, incident responder, threat intelligence analyst or forensics analyst. The certification is mapped to one NICE framework work role, Cyber Defense Analyst. There is no entry requirement to sit the exam; Centri’s recommended profile is zero to two years of experience.

A pass does not expire. Centri describes BTL1 as certification for life, with a digital certificate, a printed certificate, a Credly badge and a challenge coin on completion.

Blue Team Level 1 考试要求你做什么

The Blue Team Level 1 exam is an investigation, not a question paper. Centri gives you browser access to a compromised corporate network and 24 hours with it, and inside that window you work through 20 task-based questions. Answering them means going and finding the evidence in the environment — mail artifacts, log data, disk and memory images, threat-intelligence sources — and identifying attack vectors against the MITRE ATT&CK framework.

It is not proctored and you can sit it from home or from work. It is also open book: Centri permits course material, your own notes and search engines during the exam, and prohibits AI assistants outright, treating their use as cheating. The exam is graded the moment you submit it and you are given feedback on the questions you got wrong. If you want a submission re-checked afterwards, Centri offers a manual review that can raise a score but never lowers it.

70% passes. 90% on a first attempt earns the gold challenge coin instead of the silver. Every purchase includes two attempts, and a failed attempt carries a 10-day wait before the resit.

Blue Team Level 1 涵盖的知识领域

Centri publishes six domains for Blue Team Level 1. They are taught with the tools the work is actually done with, which is most of the point of the certification.

Security Fundamentals

Core security and networking concepts, security management, and the soft skills the rest of the course assumes.

Phishing Analysis

Identifying, categorising and analysing phishing email, retrieving artifacts from it, and choosing the right response and mitigation.

Threat Intelligence

What operational, strategic and tactical intelligence each mean, and hands-on work in MISP.

Digital Forensics

Windows and Linux investigations across both disk and memory, using tools including Autopsy and Volatility.

SIEM

Aggregating and analysing security events in a SIEM — Splunk in the course material — to detect and respond to incidents.

Incident Response

Writing and running an incident response plan: containment, eradication, recovery and improving what you do next time.

Note that CertSprint groups its own practice questions into seven categories rather than six, splitting network security monitoring out as its own set. That is our editorial choice about how to practise, not a claim about Centri’s syllabus.

Blue Team Level 1 与 CompTIA CySA+、Security+ 的比较

The two certifications people weigh Blue Team Level 1 against are CompTIA CySA+ and CompTIA Security+, and the honest answer is that they are not really substitutes. CySA+ and Security+ are timed, proctored sittings of mostly multiple-choice questions with some performance-based items mixed in. BTL1 is one long open-book investigation scored on what you actually found. They reward different abilities.

Where BTL1 is the stronger choice

It produces evidence that you can do the work: pull artifacts out of a phishing message, search a SIEM, carve a memory image and write up what happened. A multiple-choice score does not show that, and BTL1 is unusual in asking for it at entry level.

Where BTL1 is the weaker choice

Centri publishes no third-party accreditation for BTL1 — the only external mapping on its page is the NICE Cyber Defense Analyst work role. If what stands between you and the job is an advert, a government scheme or a procurement list that names certifications explicitly, a widely listed vendor-neutral certification is the safer bet, and BTL1 is not that.

BTL1 is bundled, not a standalone voucher

Centri sells the course and the exam together — listed at £399 as of September 2026, with the exam attempts included. If you already do this work daily and only want the credential, a share of that price is training you may not need.

Security+ sits earlier in the path

Security+ is broad foundational coverage of security as a subject. BTL1 assumes you have decided to specialise in defence and goes straight at the work. With no security background at all, the vocabulary Security+ drills makes BTL1’s labs considerably easier to follow.

• BTL1 vs CompTIA CySA+: a full side-by-side
• CompTIA Security+ vs CySA+: which first?
• CompTIA Security+ practice questions
• CompTIA CySA+ practice questions

备考 Blue Team Level 1 实际需要投入什么

Centri puts the course itself at roughly 30 hours: 330-plus lessons, videos, quizzes and activities, plus 23 browser labs carrying 100 hours of lab access. You get four months of on-demand access to all of it, and the exam has to be used within 12 months.

The one figure Centri publishes about real effort is lab usage — it says most clients spend somewhere between 10 and 30 of those 100 lab hours before passing the exam. It does not publish a recommended number of study weeks, so neither do we; how long this takes depends almost entirely on how much of the Security Fundamentals domain you already know. What Centri does recommend is finishing the labs and activities before booking, on the straightforward grounds that the exam is the same kind of work.

CertSprint 的练习题起什么作用

Practice questions cannot rehearse a 24-hour investigation, and we do not pretend otherwise — nothing here reproduces Centri’s exam environment, and a CertSprint percentage is not a BTL1 score or a prediction of one. What questions are good for is the recall the investigation runs on: which Windows event ID matters, what a given ATT&CK technique looks like in a log, which artifact to preserve first, what each class of threat intelligence is for. Those are the things that cost you hours in the lab when you have to look them up, and minutes when you do not.

Use the domain scores below to find the areas where your reasoning is slowest, then spend your lab hours there rather than on the domains you already answer quickly.