Skip to content
CertGPS

Blue Team Level 1

Proves you can investigate phishing, forensic, threat intelligence and SIEM evidence in a 24-hour practical incident response exam

EntryCentri

The exam

Exam cost
$529
Study time
3-6 months
Passing score
70%
Valid for
Lifetime (no renewal)

Before you book

  • None required
  • Recommended: 0–2 years of experience
  • Recommended: complete all course labs before the exam

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. Blue Team Level 1

    You are here

  2. GIAC Certified Incident Handler

    Intermediate

    Next step. GIAC's proctored incident handling exam, tied to SANS SEC504, with attacker tools added

Study guide

Last updated

BTL1 Study Guide: Centri's 24-Hour Incident Response Exam and How to Pass It

Blue Team Level 1 (BTL1) is a junior defender's certification earned in a lab: you get up to 24 hours inside a compromised corporate network and answer 20 task-based questions about what happened. Security Blue Team now trades as Centri, and certificates issued from June 1, 2026 carry the new name. Older certificates stay valid, and the course and exam are the same.

Who should take BTL1

Centri recommends it for people with up to two years of experience, and it has no entry requirements. It fits a help desk or IT support technician aiming for a first SOC analyst job, a graduate who needs hands-on evidence for interviews, or a junior analyst whose daily work is a single tool and who wants broader practice in forensics and threat intelligence. Centri maps the course to the NICE framework's Cyber Defense Analyst role.

If you have several years in a SOC already, skip to BTL2 or CDSA, which test investigations over days and grade a written report. If you haven't decided on security at all, Centri's free introductory pathway, BTJA, is a lower-stakes test of interest, and so is ISC2 Certified in Cybersecurity.

BTL1 at a glance

BTL1
FormatPractical incident response exam in a browser-based lab, 20 task-based questions
TimeUp to 24 hours
Passing score70%; 90% or more on a first attempt earns the gold coin
Price£399 for training and exam, charged in your local currency at checkout (about $529 at mid-October 2026 rates)
DeliveryOnline and open book, with no proctor; AI assistants are banned
AttemptsTwo included, 10 days apart; a third can be requested for £100
Access4 months of training and 100 lab hours; 12 months to use the exam attempts
PrerequisitesNone; 0 to 2 years of experience recommended
ValidityLifetime, with no renewal or continuing education

What the six domains cover

Centri publishes no weights, so the course outline is the best guide:

  • Security Fundamentals: networking, security controls, management principles, Active Directory and soft skills (35 topics and 3 quizzes)
  • Phishing Analysis: categorising, analysing and responding to phishing emails, including artifact retrieval
  • Threat Intelligence: operational, strategic and tactical intelligence, with hands-on MISP
  • Digital Forensics: Windows and Linux investigations with Autopsy, FTK Imager and Volatility
  • SIEM: aggregating and searching events in Splunk
  • Incident Response: plans, containment, eradication, recovery and lessons learned

The exam draws on a subset of the tools taught, and asks you to identify attack vectors using the MITRE ATT&CK framework. That means the score depends on doing things: carving an artifact out of a disk image, pulling an indicator from an email header, finding the right Splunk event. Because the exam is open book, it also rewards organized notes over memory. We'd spend the least revision time on Security Fundamentals and the most on forensics and SIEM work, where the tools take practice.

How to prepare in the four-month window

Training access starts when you click Start, not when you pay, so buy when it's convenient and activate when you have time. Activating also starts the 12-month exam clock. Centri estimates about 30 hours on its product page and 40 to 50 hours in its FAQ. Plan for the higher number, and expect more if Linux and the command line are new to you.

A plan for someone studying evenings:

  • Weeks 1 to 3: Security Fundamentals and Phishing Analysis. Keep a template for email analysis (headers, URLs, attachments, verdict).
  • Weeks 4 to 7: Threat Intelligence and Digital Forensics. Do every lab, and write down the exact commands and tool options that worked.
  • Weeks 8 to 10: SIEM and Incident Response, with Splunk searches saved to your notes.
  • Weeks 11 and 12: investigations on Blue Team Labs Online, Centri's lab platform, then the exam.

Watch the calendar more than the lab meter. You get 100 lab hours, and Centri says most people use 10 to 30 before passing. Extensions cost £100 for 31 days or £150 for 62 days and don't extend exam access.

During the exam, the 24 hours are a ceiling. Answer the questions you can confirm first, record evidence for each answer as you go, and leave time to recheck anything forensic before submitting.

Results, resits and what comes next

Grading is immediate, with feedback on wrong answers. If you think a question was mismarked, you can ask for a manual review within five working days; a review can raise your score but never lower it. A failed first attempt means a 10-day wait, then a free second attempt. Both attempts must fall inside the 12-month exam window, and a third costs £100 and is approved case by case.

BTL1 never expires. Centri doesn't issue formal CPE documentation, though it says customers have claimed credits with ISC2, GIAC and EC-Council by submitting their certificates.

Next certifications to consider:

  • BTL2, Centri's follow-on, for malware analysis and threat hunting.
  • CDSA, a seven-day investigation with a graded report.
  • GCIH, if your employer pays for SANS training.

Our view

BTL1 earns its reputation by making entry-level candidates use real tools on real evidence, which multiple-choice exams can't do. The price includes training, labs and two attempts, and Centri says about 70% pass first time. The criticism is scope: 20 questions in a day is a narrow sample, there's no written report, and an unproctored open-book exam proves less to a skeptical employer than a proctored one. We think it's money well spent for someone trying to land a first SOC job who learns by doing. With a few years of experience, put the money toward BTL2 or CDSA.

Sources