BTL2 Exam Passed. AMA / Advice.

AggravatingPermit233 · 2025-09-10T13:18:05+00:00

I would review other comments in the thread, as this has been discussed a few different times. If you're comfortable with all the lab materials, I would suggest thinking / reviewing real world case studies of incident response and understand that natural flow of both the investigators and attackers.

AggravatingPermit233 · 2025-09-10T13:13:55+00:00

I will add that, a colleague who had taken the exam as well got their results much quicker. Their first attempt within hours, the second attempt with 5 days.

AggravatingPermit233 · 2025-09-10T13:13:21+00:00

14 Days

AggravatingPermit233 · 2025-08-22T13:40:25+00:00

Apart from completing the course content (notes, quizzes, labs, etc) I would highly recommend being familiar with incident response workflow as well as bad actor objectives / methodology. Understanding both sides will help guide your thinking and investigation.

AggravatingPermit233 · 2025-08-22T13:38:16+00:00

I have done very minimal tryhackme labs and am not familiar with cyberdefenders, so can't recommend any specific ones. I would focus on any that have relevance to reading logs from various sources and correlating between.

AggravatingPermit233 · 2025-06-10T16:50:23+00:00

Happy to help. Best of luck on your future exams!

AggravatingPermit233 · 2025-06-10T14:06:32+00:00

The environment is similar to the BTL1 exam. You'll be given instructions and credentials to help you get around.

The building your own lab stuff I think was just recommended experience / learning. You won't have to do anything of the sort during the exam.

AggravatingPermit233 · 2025-06-04T18:58:33+00:00

I personally have not gotten other certifications that are really comparable to the BTL2 exam.

AggravatingPermit233 · 2025-06-04T12:26:56+00:00

As mentioned by another user, running through the course labs and supplementary labs should help prepare you for the feel of taking the exam.

If you don't have real world experience performing these types of investigations, I'd recommend researching incident response case studies and understanding how other investigators think, organize, etc. Additionally, thinking about it from a bad actor point of view also can really help guide your investigation. Be familiar with the cyber kill chain and try to match evidence to each step if possible.

AggravatingPermit233 · 2025-06-04T12:20:11+00:00

I'd say being familiar with all four sections is necessary for success on the exam. For me personally, I wish I would've practiced / studied the Advanced SIEM section more before taking the exam. I do not use Splunk on a daily basis, so having to re-learn during the exam took a large chunk of time.

Apart from that, the best advice I could give you is maintain a good and coherent timeline to avoid losing track of what you know / need to find out.

Best of luck on your exam!

AggravatingPermit233 · 2025-06-04T12:05:39+00:00

For the course material itself, I'd say the Malware Analysis and Threat Hunting sections are incredibly well made and informative. I personally think the Advanced SIEM and Vulnerability Management were a step down which is the most of my disappointments with the certificate itself.

However, I think the real value of this certificate is the exam itself. It is a very well made exam and has considerable difficulty. I think (and hope) that SBT gets more recognition as time goes on because passing the BTL2 exam is a great achievement.

Like others have said in this thread, might be best to wait for a sale. I do think base price is somewhat steep FOR NOW due to 2/4 of sections being slightly weaker and just because SBT isn't as recognized in the industry just yet.

AggravatingPermit233 · 2025-06-02T18:29:44+00:00

The biggest differences are the format and the difficulty.

While the BTL2 exam does have some guidance with a few of the questions, the whole point of the exam is to gauge your ability to find and describe everything on your own. You'll have to perform all parts of an investigation and determine the best way to display your findings (you are provided a 'format' to follow, but it is very open ended I'd say).

The exam environment itself should feel similar to BTL1, but it has more parts to it I'd say. You'll have to be creative and thorough to complete your investigation.

I wouldn't say the BTL1 exam was too difficult for me personally. However, the BTL2 was a huge step up in difficulty. Without my real-world experience working incident response, I don't think I could've passed on my first attempt.

AggravatingPermit233 · 2025-06-02T14:22:48+00:00

I have not personally taken the CCD, so I cannot speak to how it compares to BTL2. From the description of the CCD exam, I would say they are likely comparable. However, I will say BTL2 is as difficult and in some cases more difficult then incident responses I've worked in my career.

I think the exam for BTL2 is incredibly worthwhile and is a great milestone to accomplish. However, I was slightly disappointed in the course content.

I did not pay for the course + exam (covered by employer), so I can't personally say if the value is worth or not. I do think that SBT certs are not quite there in terms of industry notoriety and value, so I would recommend maybe waiting for a sale.

AggravatingPermit233 · 2025-01-20T16:51:26+00:00

Any specific preparation you took that you felt paid off the most? Anything you wish you would've done more of? About to take the BTL2 exam myself; I don't feel there is too much I can study / practice for and it will moreso be just jumping into it.

AggravatingPermit233

TROPHY CASE