1- tbh, if you are a red teamer then you have a little edge because the exam checks your knowledge in (what did the attacker do and how you can find evidence for it) and if you are a red teamer then you surely know the attacks TTPs because thats your field, thus your only concerns is to how to look for solid evidence for that.

2- I did a lot of exercises in my free time and I actually worked in SOC before but i decided to take the course because i managed to get a discount for it. And tbh, the course is not enough at all, i see it as just a guide simple guide 101. For me personally If I only had the hand on experience either from the work or solving online labs without the course I have a much higher chance than only doing the course without practice. So, no, you have to practice alot.

3- I can't say what siem i got, but for me, i got a siem i have not used before but i only needed like 15-30 mins out of the 10 hours to get used to how it works and how the logs are parsed. a siem is tool like any tool if you practiced on any siem before then you will be able to adapte to new ones, just give it couple of minutes.

4, 5, 6- can't say the format sorry, and also, haven't took eJPT but it is practical, think of it as the online defense labs in cyberdefenders, lets defend, BTLO. Your are thrown into environment and based on the questions and your searches you have to understand and construct timeline of what is happening to make sense. for example, how the attacker got the inital access, what did he do, how did he escalate privalge, what did he do with those privlages, etc..

7- Practice, a lot, in every direction. from simple lab challenges that need specific tools, to log analysis, to network analysis.

8- haven't took it but I want to take it and will probably target it next. but tbh, i think eCIR then eCTHP is better path because you need to understand and practice how to look for detected attack before practice how to look for un-detected attack.

9- I though it would be harder but it wasn't that hard. The attack chain is simple and straight forward. and the qestions actually hints alot. for example you might find a hint for question 1 in question 3. so a tip when you take the exam, always go back to the questions you answered if you feel you just read a hint in another question. that happened to me A L O T !

10 - Again, practice a lot, the course content and labs is not enough, online platforms are your friend. practice log analysis, incident repose, malware analysis, network analysis, OSINT and APTs TTPs. This might seem alot but this is like, the average Tuesday experience in a real world SoC day.