BTL1 exam-day guide
BTL1 · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Confirm with the provider which ID types are accepted and that the name matches your registration exactly; bring the physical original, not a photocopy.
Exam appointment confirmation and login details
Have your confirmation email, candidate/registration number, and portal credentials accessible. Confirm with the provider whether the exam is taken in a browser or via a proctoring application.
Stable computer and internet connection
If the exam is remote-proctored, use a wired or strong connection, close bandwidth-heavy apps, and run any required system or equipment check in advance. Confirm minimum technical requirements with the provider.
Webcam, microphone, and speakers/headset
Most remote proctoring requires a working camera and mic. Confirm with the provider whether headsets are permitted or whether speakers only are allowed.
Clean, quiet, private room
Clear your desk of notes, phones, and second screens. Confirm with the provider the rules on permitted items (water, tissues, scrap paper) and whether the room will be scanned.
Permitted reference or materials check
BTL1 is generally a closed-book style assessment; confirm with the provider whether any notes, calculators, or reference sheets are allowed before assuming anything.
Scratch paper and pen (only if permitted)
Useful for reasoning through log and evidence questions. Confirm with the provider whether scratch paper is allowed and whether it must be shown and destroyed afterwards.
Water and a light snack for before the exam
Keep these off the desk unless the provider allows them; hydration and a small snack before the session help sustained attention.
Restroom and break plan
Confirm with the provider whether breaks are allowed, whether the clock pauses, and how to signal a proctor if you must leave the screen.
Backup plan for technical failure
Know the provider's support contact and their policy for technical interruptions. Have a phone (kept away from the exam area) or second device ready to reach support if needed.
Time-zone and start-time double check
Convert your scheduled start time to your local time zone and plan to be ready early; confirm with the provider the check-in window and late-arrival policy.
Review the candidate handbook / rules page
Read the current exam handbook for conduct, scoring, and retake rules. Policies change, so confirm with the provider rather than relying on older forum posts.
Plan the day
Shift from learning new material to consolidation. Review your own summary notes on the core domains (phishing analysis, threat intelligence, digital forensics, SIEM/log analysis, incident response) and re-read the exam handbook for format and rules. Confirm your appointment, ID, and technical setup, and run any system check the provider offers. Sleep on a normal schedule rather than cramming overnight.
Do light review only: skim your notes on recurring question patterns (identifying phishing indicators, reading log fields, matching evidence to an attack stage) without starting new topics. Prepare your workspace, charge devices, test camera/mic/internet, and set out your ID and login details. Confirm the start time in your local zone and set two alarms. Aim to stop studying early enough to get a full night's sleep.
Eat a proper meal, hydrate, and avoid heavy caffeine if you are sensitive to it. Do a final 10-15 minute skim of your summary sheet, not a deep dive. Log in early, close all other applications, silence notifications and phones, clear your desk, and complete any ID or room check calmly. Take a few slow breaths and read the first question carefully before answering.
Read each question fully and watch for qualifiers such as 'most likely', 'best', or 'first'. Answer the questions you know first, flag uncertain ones, and return to them with remaining time. For log and evidence questions, identify the key fields (timestamp, source/destination, user, process, action) before choosing. Manage the clock: note the time remaining at checkpoints and avoid spending too long on any single item. If a technical issue occurs, pause and contact the proctor or support as instructed rather than troubleshooting alone.
Note which topics felt weakest while it is fresh, so any future study or retake preparation is targeted. Confirm with the provider how and when results are released and what the retake policy is, rather than relying on secondhand information.
Rules to check
Bring the exact ID required by the provider and ensure the name matches your registration; if your ID name differs, contact the provider before exam day to resolve it.
Follow all proctoring instructions: complete identity and room checks, keep your face in view, and do not leave the camera's field of view without permission.
Do not use unauthorized materials, notes, second screens, phones, or communication tools during the exam; treat anything not explicitly permitted as prohibited.
Confirm with the provider in advance whether breaks are allowed, whether the timer runs during breaks, and how to request one; do not assume you can pause the clock.
Understand the scoring model before you sit: confirm with the provider whether scoring is per-domain, whether there is a passing threshold, and whether partial credit applies to any question type.
If you experience a technical failure, stop and follow the provider's documented support process; do not attempt to restart or reconnect repeatedly without guidance, as this may affect your attempt.
Keep the content of the exam confidential as required by the provider's candidate agreement; do not share, record, or reproduce questions.
If you are unsure about any rule, ask the provider's support team before exam day; policies on ID, permitted items, and retakes vary and should be confirmed directly.