Getting Started

Once enrolled, you can start your BTL2 exam at any time within your access period.

Before sitting the exam, we recommend completing all course materials and labs, quizzes and activities to ensure you are fully prepared.
 

Exam Format

The BTL2 exam is a practical, 72-hour incident response exam.

• Role simulation: You take on the role of an incident responder tasked with investigating an advanced intrusion within a corporate network.
• Scenario details: On starting the exam, you receive detailed scenario information, a report template, and instructions for navigating the environment.
• Lab access: The exam environment is accessible directly through your browser.
• Multi-day format: The 72-hour window is designed to give you the flexibility to take breaks, rest, and manage other commitments without undue pressure.
• Report submission: Complete your report using Microsoft Office or Google Docs, then upload it through the submission portal. You can make revisions, but the final report must be submitted within the 72-hour window. 
• Open book: You can use your course materials, search engines, and personal notes during the exam.

Important: Make sure you upload your PDF report with enough time to spare before your exam window closes. Uploads can be delayed by slow connections, timeouts, or large file sizes, and a report submitted too close to the deadline may fail to go through. We recommend uploading well ahead of time rather than in the final seconds to avoid missing the deadline.

Please note: The use of AI tools (including but not limited to ChatGPT, Gemini, Copilot, or any similar AI assistant) is strictly prohibited. Seeking help from AI or other individuals is considered cheating and may result in disqualification. For full exam rules, please review the BTL2 Exam NDA before sitting. 

Submission and Grading

Your submitted report is reviewed and graded by the marking team. Results and feedback are provided within the SLA timeframe once marking is complete.

• A score of 70% or above is required to pass and earns you the silver challenge coin. 
• A score of 90% or above on your first attempt earns you the gold challenge coin. 

For full details on marking timeframes, see Exam Result Review & SLA Timeframes.

Important: 

Resit Policy

• Each BTL2 purchase includes 2 exam attempts.
• If your first attempt is unsuccessful, your second attempt is at no additional cost.
• You must wait at least 10 days after a failed attempt before resitting
• The 10-day waiting period applies to all resits

For full details on exam access and extensions, see Certification and Exam Access

Still need help?

Submit a support ticket and our team will be happy to help.