Experience taking the BTLO1
As a reference, before taking the BTL1 exam, I had my Sec+ and I was freshly graduated from Montgomery College.
The websites that I used as resources were the following:
2- https://www.linkedin.com/pulse/how-i-passed-blue-team-level-1-btl1-exam-earning-rare-ekedoro-omfdf/
3- https://passthehash.co.uk/posts/Blue-Team-Level-1-Review/
5- https://medium.com/@enleak/my-security-blue-team-level-one-exam-experience-16d42f4d93ea
MY TIPS
1- I remember reading this in multiple places:
The most crucial tips that I could suggest from my own experience may be a little different than anyone else’s, but they worked in my case:
“BTL1 is an open-book, open-internet exam, so create cheat sheets and notes. I even saved Splunk-created walkthroughs regarding the Splunk Enterprise platform.”
I can tell you from someone with no hands-on experience, this can be a double-edged sword. Try to have your cheat sheets/notes on hand and limit the use of someone else’s notes. I felt a little overwhelmed when I tried to google at times.
2- “Schedule breaks during your exam. Sometimes you need to reset your eyes and mind to find answers you wouldn’t have before.”
I did plan my entire Sunday for the exam, but…
As you can see on my schedule above, I tried to plan the whole day, but at the end I made adjustments. I decided to take the breaks when I felt like I could pause the investigation. At times, I was so focused on certain questions that hours just passed by. Overall, I will advise scheduling the number of breaks you should take in the day and how long they should be, but not necessarily at what time.
3- Organize what/how/where to display on your multiple screens, as you can see in the image below.
I believe that this facilitates how you are going to build your timeline, take notes in general, and use your notes.
4- “Skip questions and come back if you need to; other questions may lead you to the answer you couldn’t find.”
Be familiar with all 20 questions; one answer may bring you naturally to another question, not necessarily to the next question.
5- “Stay calm; maintain composure for a clear mind; treat the exam as a mini-marathon, not a sprint.”
6- Besides the BTL1 content, practice with all the tryhackme/Blue Team labs mentioned in the resources link; you will thank me later.
7- The last but maybe the most important tip I could provide is:
Due to the NDA agreement, all I can say is, from what I learned from the entire course, with so many tools in our belt, maybe just maybe there is a way to revise your own answers. Specialty, in those questions, where you are not 100% sure about your answer.
