My BTL 1 Certification Journey: Preparation to the 24-hour exam

“You have 24 hours to finish the exam. It seems challenging, high pressure and time consuming. But brace yourself for the truth.”

Hello, I am Akhil Jain(M.Eng. Cybersecurity Engineering) and I recently appeared for the BTL1 examination and completed this 24 hour exam in 9 to 10 hours with a 95% score which makes me eligible for the Security Blue Team’s prestigious gold challenge coin. The following will be the account of this journey along with an honest opinion about this certification.

My cert. YAY!!!

THE PREPARATION PHASE:

This exam consists of various domains like Phishing, Digital Forensics, Threat Intelligence, SIEM and Incident Response. The time required by anyone to prepare for this certification (or anything for that matter) depends on person to person. The amount of time they can invest, the content they can grasp in that time frame, etc. If one having basic to intermediate understanding of cybersecurity concepts, it should be a matter of about 30 to 35 days with a preparation time of around 4 hours/day. Personally, it took me about 25 days of preparation with around 2 to 3 hours a day. While this time span seems to be short but it is because life isn’t really a vacuum. This preparation was midst me completing my masters degree, along with the part time job and other day to day chores. Also, my Computer Engineering and Cybersecurity Engineering background already gave me a foundation with the concepts of networking, phishing, forensics and SIEM which helped me huge as it allowed me to go through many of the topics faster and helped me focus on some of the things which were newer to me.

So, for the cybersecurity students living with a lot of other things along with your coursework:

• Audit your knowledge: The only person who has the best assessment of your knowledge is YOU. You are very well aware of what you have learnt till date from coursework and other resources and study platforms.
• Step on the accelerator: Using your existing knowledge, go through the modules with a faster pace. While you studying the modules, you will come through the topics you already know about. Still DO NOT SKIP them entirely. Go through those in a way like a summary and then directly go for labs which you can complete in half the estimated time for it. For example, in the forensics module, going through the volatility part was a breeze. I only went on to reading the important parts like the commands as I was already familiar with the tool but going through the commands was a refresher.

For people who have a basic to intermediate understanding of this field, do not worry. As said, no one lives in a vacuum and understanding people do have social obligations, just 4 to 5 hours a day and according to my understanding you can be exam ready within 30 to 35 days. Also, when I say basic to intermediate understanding, I mean a surface level understanding (or a bit deeper) of topics like:

• Networking: You understand what computer networks are. You understand what OSI model is and terms like IP, MAC, PORTS, etc. don’t confuse you.
• The Tale of Evidence: You do understand that every attacker leaves their traces in the form of logs or any file, basically, a digital footprint.
• Operating Systems: Though not a pro user but you do see your way through Windows/Linux environment and command prompt, powershell, terminal doesn’t scare you away.

With this, you can actually go through the modules in about 3 to 4 days each. The most important part is to be DEAD HONEST with the labs. Try your hardest to do the labs on your own and refer to the solutions only when you do not see a way. Also, you should practice the labs atleast twice. Rest keep on pushing yourself and you will get there eventually. And yeah KEEP NOTES!!!

The D-Day preparation is just go through the lab solutions once like a refresher of what you have learnt throughout (this goes for both the categories mentioned above).

THE EXAM DAY:

(I will not write in much detail in this section as I want to avoid violating the policies of SBT)

I’ll be honest, when I started the exam and went through the given scenario and all, despite all my preparation, it took me more time than it should just to spot the culprit event which turned out to be the initial entry point. This shouldn't have been the case but on a bad day anything can happen. There is a probability that you might as well get stuck on something and experience a tunneled vision. Just don’t get upset about it and just keep on looking the things again and again as you may have missed some detail which actually leads to the answer(it’s a life lesson too).

Once I caught that initial clue, the pieces of the puzzle started falling into place and the answers to the next few consecutive questions were found in a blink. The knowledge of phishing, forensics, incident response, persistence, etc. gained in the course was used to investigate the incident and answer those 20 questions.

This is how that slow turtle start evolved into the rabbit sprint which helped me answer all the 20 questions and complete the exam in around 9 to 10 hours. I hit the ‘Submit’ button with a mix of exhaustion and excitement, and seeing that 95% flash on the screen made every hour of preparation and that stressful ‘turtle’ start was completely worth it (Though I was sad about where did I go wrong for not getting a 100)

HONEST OPINION:

SHOULD I TAKE THIS CERTIFICATION? This is a very important question to consider before you take any certification. I do understand that the certifications in our field are important but very expensive on the other hand and this one’s no less as it costs GBP 399.

The way I would look at this certification is that it is a basic beginner level certification. According to me:

• You should take this certification if: You do not have any professional work experience and as certifications are a key to landing your first job, having this certification might look like a really great addition to your certification stack.
• Do not if: You have a year or two worth of experience as you already have more knowledge than you can get from this certification. As for resume enhancement, your experience is more than enough as it will outshine this certification by miles and this certification might seem like an unnecessary component.

So, SHOULD YOU TAKE THIS CERTIFICATION? Well, you have the answer, duh!

So, good luck to all of you and KEEP DEFENDING!!! (And yeah congratulations for your GOLD CHALLENGE COIN)