BTL1 study guide
BTL1 · Work through your exam, one topic at a time.
Blue Team Level 1 (BTL1) is a practical, entry-level defensive cybersecurity certification from Centri (Security Team Training Ltd). It is built for security enthusiasts and professionals who want hands-on defensive skills, and the vendor positions it for students, IT personnel, security analysts, incident responders, threat intelligence analysts, and forensics analysts, with a recommended experience level of 0-2 years. The BTL1 study guide has 5 sections and about 1,607 words.
01Phishing Analysis: From Raw Email to Verdict
Phishing triage rewards a fixed order of operations. Start with the full headers : the From display name is cosmetic, so compare the From: header domain against the Return-Path (envelope sender), the Reply-To , and the domain in the Message-ID .
351 words, about 2 min02Threat Intelligence: Sources, Standards, and Judgement
Threat intelligence questions test whether you can pick the right source and the right level of confidence. Know the lifecycle: direction (requirements), collection , processing , analysis , dissemination , feedback .
328 words, about 2 min03Digital Forensics: Order of Volatility and Evidence Integrity
Forensics questions hinge on order of volatility : collect CPU registers and cache, then RAM, then network state and running processes, then temporary files and disk, then remote logs and archives. Capture RAM before pulling the plug, because memory holds encryption keys, network connections, and injected code that vanish on shutdown.
312 words, about 2 min04SIEM: Detection Logic, Tuning, and Correlation
A SIEM ingests logs, normalizes fields, correlates events, and fires alerts. Understand the pipeline: collection (agents, syslog, API), parsing/normalization to a common schema, enrichment (GeoIP, asset criticality, threat feeds), correlation rules , and alerting .
308 words, about 2 min05Incident Response: Phases, Decisions, and Communication
Incident response follows a repeatable lifecycle: preparation, identification, containment, eradication, recovery, and lessons learned . Know that containment has short-term and long-term options, and that the decision to isolate a host trades evidence preservation and business impact against attacker spread.
308 words, about 2 min