Security Blue Team Blue Team Level 1 (BTL1) Study Guide: 30-Day Preparation Plan and Checklist

The Security Blue Team Blue Team Level 1 (BTL1) exam is built for people who want to prove they can think and work like a defender, not just recite theory. If you are aiming for a SOC role, moving from general IT into security, or sharpening your incident response and detection skills, this guide gives you a practical 30-day plan. The goal is simple: help you study in a structured way, cover the main blue team domains, and avoid the common mistake of reading too much without practicing enough.

Who should use this BTL1 study guide

This guide is a good fit for three kinds of learners.

• New blue team learners who need a clear starting point.
• IT professionals with networking, system administration, or help desk experience who want to pivot into security operations.
• Junior SOC analysts who want a tighter study plan before sitting the exam.

BTL1 is practical by design. That matters because many candidates spend too much time passively reading notes and not enough time reviewing logs, understanding alerts, and tracing attacker behavior. This exam rewards methodical thinking. You need to know how to identify suspicious activity, interpret evidence, and make sensible response decisions.

What the BTL1 exam is really testing

At a high level, BTL1 tests whether you can operate as an entry-level blue team analyst. That means more than knowing definitions. You should be comfortable with the following:

• SOC workflows such as alert triage, escalation, and documentation.
• Detection basics including log analysis, threat indicators, and attacker behavior.
• Incident response thinking such as scoping, containment, evidence review, and next steps.
• Network and host visibility so you can interpret what happened on a system or across a network.
• Tool awareness including common blue team platforms and investigation methods.

The exam goal is not to turn you into a senior responder. It is to show that you can work through realistic defensive tasks without guessing. That is why a study plan should focus on understanding the logic behind each answer, not just memorizing facts.

Prerequisite knowledge and tools to know before you begin

You do not need years of experience, but some baseline knowledge makes preparation much easier.

Helpful prerequisites:

• Basic TCP/IP and networking. Know ports, protocols, DNS, HTTP, and how traffic flows.
• Windows and Linux basics. Know processes, services, users, file paths, and logs.
• Security fundamentals. Understand malware, phishing, privilege escalation, persistence, and lateral movement at a basic level.
• Log reading. You should be willing to slow down and inspect timestamps, usernames, source IPs, process names, and event patterns.

Useful tools and concepts to review:

• SIEM basics and alert triage process
• Wireshark or packet analysis basics
• Windows Event Logs
• Linux logs such as auth and syslog
• Simple threat hunting logic using indicators and suspicious behavior
• Phishing email review, header analysis, and attachment risk checks

If one of these areas is weak, that is not a problem. It just means you should identify it early. A 30-day plan works best when weak areas are found in week one instead of the night before the exam.

30-day BTL1 study plan

This plan is built around five stages: foundation, domain review, practice questions, weak-area repair, and final revision. The structure matters because blue team skills improve through repetition and review, not through one long reading session.

Days 1 to 6: Build the foundation

• Day 1: Review the exam objectives. Write down the main domains in your own words. This helps you see the full map before diving into details.
• Day 2: Study networking basics. Focus on DNS, HTTP, TLS, common ports, and what normal traffic looks like. You need this to spot abnormal behavior later.
• Day 3: Review Windows fundamentals. Pay attention to accounts, processes, scheduled tasks, services, startup locations, and event logging.
• Day 4: Review Linux fundamentals. Focus on users, permissions, processes, cron jobs, SSH, and common log files.
• Day 5: Study SOC workflow. Practice moving from alert to triage to investigation to escalation. Think in steps, not isolated facts.
• Day 6: Review incident response basics. Learn the difference between identifying, scoping, containing, eradicating, and recovering from an incident.

Day 7: Do a short review session. No new topics. Summarize what you learned in one page. If you cannot explain a concept simply, you probably do not understand it well enough yet.

Days 8 to 16: Domain review and hands-on thinking

• Day 8: Email security and phishing analysis. Review common signs of spoofing, urgent lures, malicious links, and risky attachments.
• Day 9: Log analysis fundamentals. Work through sample events and identify what fields matter most.
• Day 10: Network traffic review. Focus on suspicious connections, unusual destinations, repeated failures, and signs of command and control.
• Day 11: Malware behavior basics. Study persistence, process spawning, file changes, and beaconing patterns.
• Day 12: Threat intelligence and indicators. Learn how to use IPs, hashes, domains, and behavior carefully. Indicators help, but context matters more.
• Day 13: Detection logic. Review how rules and alerts work and why false positives happen.
• Day 14: Windows-focused investigation practice. Read events in sequence and build a timeline.
• Day 15: Linux-focused investigation practice. Trace authentication activity and suspicious command execution.
• Day 16: Triage drill. Take one alert and answer four questions: What happened? Is it malicious? How severe is it? What should happen next?

Days 17 to 22: Practice questions and explanation review

• Day 17: Take a timed mixed practice set. Do not pause after every question. Train yourself to make decisions under time pressure.
• Day 18: Review every explanation from day 17. For each wrong answer, write why your choice was wrong and why the correct one was better.
• Day 19: Take a domain-specific set on your weakest topic.
• Day 20: Review explanations again. Look for patterns. Are you missing keywords? Rushing? Misreading logs?
• Day 21: Take another mixed set, timed.
• Day 22: Review and update your weak-area list.

After this stage, you should not just know your score. You should know why you are losing points. That is what improves performance.

Practice with the relevant page only: Security Blue Team Blue Team Level 1 (BTL1) Practice Test

Days 23 to 27: Weak-area repair

• Day 23: Revisit your weakest technical domain. For example, if Windows events are confusing, spend the day mapping common event patterns and what they mean.
• Day 24: Revisit your weakest workflow domain. For example, if triage decisions are weak, practice classifying alerts by confidence, impact, and urgency.
• Day 25: Do short targeted drills. Five to ten questions at a time is enough if the review is deep.
• Day 26: Build mini timelines from sample scenarios. This improves your ability to connect separate clues.
• Day 27: Retest weak topics under timed conditions.

Days 28 to 30: Final revision

• Day 28: Take a final mixed practice exam. Simulate exam conditions as closely as possible.
• Day 29: Review only high-value notes. Focus on recurring mistakes, triage logic, and common investigative patterns.
• Day 30: Light review only. No cramming. Rest matters because tired candidates miss details they normally catch.

How to review explanations without memorizing answers

This is where many candidates go wrong. They repeat the same practice questions until the answers feel familiar, then mistake recognition for understanding. That creates false confidence.

Use this review method instead:

• Hide the correct answer first. Before reading the explanation, ask yourself what clue you missed.
• Find the deciding evidence. Was it a timestamp, process name, port, parent-child process relationship, or email header detail?
• Write one rule in plain English. Example: “Repeated failed logins followed by a success from the same external IP may suggest brute force or password spraying.”
• Create a variation. Ask how the answer would change if one detail changed. This forces flexible thinking.
• Track mistake types. Common types are content gap, rushed reading, poor elimination, and overthinking.

The reason this works is simple. The exam will not reward memory of one exact question. It will reward your ability to recognize patterns in slightly different forms.

Final-week readiness routine

Your final week should be about stability, not panic. A calm, repeatable routine often lifts performance more than one extra late-night study session.

Use this checklist:

• Review your summary notes once per day, not all day.
• Do one timed set every one or two days to keep your pace sharp.
• Stop adding new resources. Too many sources create noise.
• Sleep properly. Blue team questions often depend on small clues, and fatigue makes those easy to miss.
• Practice reading slowly enough to catch detail but fast enough to protect time.
• Prepare your exam environment early if the exam is remote.

A good final-week rule is this: if a study activity increases confusion more than confidence, it is probably the wrong activity for that stage.

SOC triage checklist for exam practice and real-world use

This checklist is useful for BTL1 preparation, but it also works as a simple reference for junior analysts and training teams.

• What triggered the alert? Identify the rule, event, or behavior.
• What asset is involved? Hostname, user, IP, email account, or server role.
• Is the activity expected? Compare with normal admin work, patching, scripts, or business processes.
• What is the evidence? Pull the exact log fields, process names, domains, hashes, or timestamps.
• What is the likely severity? Consider impact and confidence, not just alert volume.
• Is there spread or repetition? Check if other hosts, users, or time ranges show the same pattern.
• What immediate action is needed? Monitor, enrich, escalate, isolate, or close as benign.
• How will you document it? Write a short, evidence-based summary with next steps.

This matters in the exam because good triage is structured. It is not just “this feels suspicious.” It is a reasoned assessment based on evidence and impact.

FAQ

How many hours per day should I study for BTL1?

For most people, 1.5 to 3 focused hours per day is enough over 30 days. More can help, but only if the time is active. Three hours of log review and question analysis beats six hours of passive reading.

What if I do badly on practice questions early on?

That is normal. Early scores are diagnostic. They show where your gaps are. Use them to shape the next week of study instead of taking them personally.

Should I retake the same practice questions?

Yes, but not immediately and not as your main method. Retakes are useful after review because they show whether you fixed the underlying weakness. If your score improves only because you remember the answer, the retake was not very useful.

How do I manage time during the exam?

Do not get stuck proving every answer beyond doubt. If a question is taking too long, eliminate weak options, make the best choice based on evidence, and move on. Blue team work often involves making the best decision with limited information.

Do I need deep malware reverse engineering knowledge?

No. For BTL1, practical blue team understanding matters more. You should recognize suspicious behavior and common signs of compromise, but you do not need advanced reverse engineering skill.

What if I need to retake the exam?

Treat a retake as feedback, not failure. Review your weak domains, study your mistake patterns, and rebuild your plan around them. Most failed attempts are not caused by lack of effort. They are caused by scattered preparation or too little practice under realistic conditions.

Final thoughts

BTL1 is a strong exam for people who want to build practical defensive skills. The best way to prepare is to think like an analyst every day for a month. Read carefully. Practice regularly. Review your mistakes honestly. If you follow a structured plan and focus on reasoning instead of memorization, you will not just be preparing for an exam. You will be building habits that carry over into real SOC and incident response work.