BTL1 performance-based questions: what they are and how to practise them
BTL1 is a 24-hour practical incident-response assessment from Centri, formerly Security Blue Team. You investigate a lab environment and receive immediate grading and feedback. Our short practice tasks build supporting skills and do not reproduce that exam environment.
Why these questions exist
Whether you can investigate evidence and reach supported conclusions. Practise working with phishing artifacts, logs, forensic data, and incident-response workflows in a hands-on environment.
On the real exam these appear as applied investigation tasks. Open book and unproctored — course material, personal notes and search engines are allowed, AI assistants are prohibited
- Record findings with their supporting evidence so you can verify each conclusion and distinguish an observation from an assumption.
- Use the full window rather than treating it as a timed sitting. It exists so you can be thorough.
- Keep contemporaneous notes as you work. Reconstructing your reasoning at the end is slower and less accurate than recording it as you go.
How we practise them
Our BTL1 bank contains 44 PBQ-style exercises in two formats: matching tasks, where you pair each requirement to the capability that satisfies it, and ordering tasks, where you sequence the steps of a procedure. Each one carries the same full explanation as the multiple-choice questions, covering why the correct arrangement is right and why the plausible alternative is not.
These train the reasoning the exam tests — sequence, placement, and matching — rather than reproducing a vendor's simulation interface. Nothing here recreates the exam environment itself, and no practice product legitimately can.
Because the BTL1 exam is practical, our exercises here train the underlying reasoning rather than mirror the exam interface. Confirm current pass thresholds and retake terms on the official Security Blue Team page, as they change periodically.
See where you stand on BTL1
25 free questions, no card required. Your domain scores show which areas need work before you book the exam.
Learn the decision behind the answer.
Work through the scenario, identify the evidence that matters, then compare your reasoning with the explanation. Use domain scores to choose your next study session. A practice percentage is a learning signal, not a prediction or an official exam score.
BTL1 is a practical investigation exam. These questions and matching exercises complement hands-on labs; they do not reproduce the provider’s exam environment.