BTL1 is a practical exam, not multiple choiceBTL1 is a 24-hour practical incident-response assessment from Centri, formerly Security Blue Team. Candidates investigate a lab environment and receive immediate grading and feedback. The current course includes one free resit. Our short exercises support the underlying skills; they do not reproduce the practical exam.
BTL1 covers ground CySA+ does notCentri publishes six BTL1 domains — security fundamentals, phishing analysis, threat intelligence, digital forensics, SIEM and incident response — and teaches phishing analysis, forensics and threat intelligence as subjects in their own right. CySA+ folds several of these into broader domains.
The exam provider charges for certification. CertSprint is independent practice; its question-bank price does not include an official exam voucher, provider training or a lab subscription.
Provider fees and scope links · pricing snapshot 18 October 2026
Decision
BTL1
CySA+
Official exam and timing
BTL1. 20 task-based questions answered from evidence you find in a compromised corporate lab. 24 hours of in-browser lab access, started whenever you feel ready.
CS0-004. Up to 85 questions. 165 minutes.
Provider cost
Centri lists £399 GBP for training and the exam, including one free resit voucher. Confirm the current package before purchase. Provider pricing and terms
An exam voucher is purchased separately. Check the current CompTIA price for your country and booked version. Provider pricing and terms
Scope to check
Security fundamentals, phishing analysis, threat intelligence, digital forensics, SIEM and incident response. Official scope
Use the CS0-004 exam objectives for CS0-004 preparation; do not substitute the older CS0-003 weighting. Official scope
Practical preparation
Investigate evidence in a hands-on lab. Multiple-choice practice cannot reproduce the practical exam.
Interpret alerts, vulnerability evidence and response decisions across different security products.
Try three questions. Understand every answer.
Original English practice examples, with answers and explanations available here. No account required. These are independent teaching examples, not official exam questions or exam dumps.
BTL1 is a practical investigation exam. These multiple-choice examples rehearse analytical decisions; they do not reproduce its hands-on exam format.
Question 1 of 3 · BTL1 · Phishing and security operations
Answer and explanation
Best answer: Integrity is unverified and the mismatch needs investigation
The mismatch means this copy has not passed integrity verification. Preserve the acquisition record and investigate the transfer or obtain a verified copy before relying on it.
Why the other choices fit less well
Names and sizes can remain unchanged when bytes differ. Silently replacing the acquisition hash conceals the discrepancy and undermines the evidence record.
Question 2 of 3 · CySA+ · Security monitoring and threat detection
Answer and explanation
Best answer: Correlate process ancestry, arguments, connections, and surrounding events
A legitimate signed utility can be abused. The unusual execution context and network behavior justify a focused investigation, but still need corroboration before a final conclusion.
Why the other choices fit less well
A signature alone does not prove benign use. Blocking one destination and closing the case loses scope and execution context; common tool usage does not invalidate the observed evidence.
Best answer: Preserve the message and inspect headers and destinations in the approved analysis environment
Preserve the original message and inspect the actual addressing and destinations safely. The discrepancies support investigation without requiring a risky visit from a normal workstation.
Why the other choices fit less well
A display name is not proof of origin. Opening the link on production exposes the user. Mass forwarding spreads potentially harmful content and can alter the evidence context.
Paid question-bank access is a one-time purchase, with no recurring subscription. Official exam registration, vouchers and provider labs are separate from CertSprint practice.
两场几乎截然不同的考试
BTL1是一场为期24小时的实操型事件响应考试。你可以自行选择开始时间，在浏览器中调查一个被入侵的企业实验环境，并根据找到的证据回答20道任务型题目。它是开卷且无监考的：允许使用课程资料、个人笔记和搜索引擎，但不允许使用AI助手。及格线为70%，达到即可获得银色挑战币（challenge coin）；首次尝试达到90%可获得金色挑战币。课程与考试打包出售，售价399英镑，含一张免费补考券，更多补考可另行购买。Centri（前身为Security Blue Team）不公布入学要求，课程面向在入门或初级岗位上有零到两年经验的人。
CySA+有四个领域。在CS0-003中，权重为安全运营（Security Operations）33%、漏洞管理（Vulnerability Management）30%、事件响应与管理（Incident Response and Management）20%、报告与沟通（Reporting and Communication）17%；在CS0-004中，权重变为34%、26%、24%和16%。漏洞管理占CySA+近三分之一，在BTL1的考纲中没有对应内容；报告在CySA+中是计分领域，而BTL1把文档记录视为调查的一部分，而非单独科目。反过来的差距在取证和钓鱼分析，CySA+只在更宽泛的领域内略有涉及，BTL1则深入讲授。
