This article covers everything you need to know about the BTL1 exam - how it works, how it's graded, and what happens if you need to resit.
Getting Started
Clients enrolled in the BTL1 course can kickstart their practical 24-hour incident response exam at any time within 12 months of purchase. This exam offers a hands-on experience, allowing candidates to demonstrate their skills in real-world scenarios.
Before sitting the exam, we recommend completing all course materials and labs, quizzes and activities to ensure you are fully prepared.
Exam Format
The BTL1 exam is a practical, 24-hour incident response exam
- Lab Access: Through an in-browser session, clients gain access to a compromised corporate lab for up to 24 hours.
- Task-Based Questions: The exam comprises 20 task-based questions, encouraging candidates to utilize various tools, investigate vulnerabilities, whilst identifying certain attack vectors according to the ATT&CK Framework.
- Flexible Setting: Take the exam anywhere without the constraints of traditional proctoring, whether at home or at work
- Open-Book Format: Candidates are able to use e-learning resources, search engines, and personal notes to carry out questions.
Please note: The use of AI tools (including but not limited to ChatGPT, Gemini, Copilot, or any similar AI assistant) is strictly prohibited. Seeking help from AI or other individuals is considered cheating and may result in disqualification. For full exam rules, please review the BTL1 Exam NDA before sitting.
Submission and Grading
The exam is graded immediately upon submission and you receive feedback on any incorrectly answered questions.
- A score of 70% or above is required to pass and earns you the silver challenge coin.
- A score of 90% or above on your first attempt earns you the gold challenge coin.
Feedback on incorrect answers is designed to give you a general understanding of where you went wrong, to help with preparation if a resit is needed. For full understanding of how the submission grading works, see Exam Marking Policy
Important:
If you'd like your submission re-checked after results are released, you can request a manual review from the Exam Marking Team. Reviews are independent of the original marking and may increase your score, but never lower it.
See Exam Result Review Policy & Marking Timeframes for full details on eligibility, timeframes, and how to request a review.
Resit Policy
Two Exam Attempts Included: Each BTL1 purchase includes a total of two exam attempts.
Second Attempt (Retake): If your first attempt is unsuccessful, you are eligible for a second attempt at no additional cost.
- Resit Restrictions: You must wait at least 10 days after a failed attempt before resitting.
For full details on exam access and extensions, see Certification and Exam Access.
Still need help?
Submit a support ticket and our team will be happy to help.