CBTeamerX Exam Review & How to Prepare Yourself for This Exam

Hello everyone, it's me Chicken0248 again, and in this blog post I'll give you a review of the Certified Blue Teamer eXpert (CBTeamerX) exam from The SecOps Group, a company that focuses exclusively on practical exams with no associated courses, and is now expanding into the blue team space. I had already attempted their intermediate-level blue team exam, CBTeamer, which was quite fun, so I wanted to take their "expert" level exam next. It did not disappoint on content, but my first experience was far from enjoyable, as you'll find out. And yes, I took this exam twice.

CBTeamerX was released in January 2026 as The SecOps Group's first blue team "expert" level exam, priced at 400 GBP (their standard price for all expert-level exams). However, it also comes with a 90% discount, which brings the actual cost down to around 48 GBP including VAT. Since no course is bundled with the exam, keep that in mind when comparing the cost against other vendors.

This model has some similarities with GIAC: you're not required to take a SANS course to sit the exam (those run around $8,900 per course). At least GIAC is globally recognised and its certifications are listed in DoD 8140. The same can't be said for The SecOps Group, so in my opinion, purchasing at full price is quite expensive relative to the return. If you're interested, wait for a discount.

You can also see that The SecOps Group compares CBTeamerX to BTL2, GSOC, CCD, and MBT, which is a very bold claim. I have no idea who put that comparison together, and I don't know whether the team who designed this exam has actually attempted those certifications (neither have I, LOL).

Compared to those certifications, CBTeamerX lacks global recognition: it's very new, has no associated course, and The SecOps Group is not yet a well-known name at the scale of Centri, GIAC, CyberDefenders, or Mosse Institute. It won't carry much weight in a job search right now.

That said, if you still want to take the exam, to test your knowledge, for fun (like me), or because you received a giveaway, the next section is for you.

The SecOps Group provides both "learning resources" and an "exam syllabus." After taking the exam, I'd say not everything in the syllabus actually appears, but the learning resources are more closely aligned with what you'll encounter. Here's what you need to prepare:

• Splunk, with Sysmon and AWS CloudTrail log sources
• AWS CloudTrail: know or be able to look up suspicious API calls (eventName), such as GetCallerIdentity (whoami in AWS), GetObject (S3 retrieval), CreateUser, and so on
• Malware reverse engineering with IDA (or another decompiler/debugger of your choice)
• Windows API knowledge: this comes with malware RE; be able to look up what each call does
• Script-based malware analysis (JavaScript and PowerShell)
• Basic Windows disk analysis (Sysmon logs reduce the need for heavy forensics tooling)
• Basic Windows & Active Directory attacks and privilege escalation detection (nothing too advanced)

In my opinion, none of these domains are pushed to an extreme depth. If you're a SOC L2 analyst by the global definition, you should be able to move through this comfortably.

Assuming you have that knowledge and want to take the exam, I'll walk through my experience in the next sections. I won't give away exact answers, so you'll need to read between the lines. But first, here's how the exam actually works.

CBTeamerX is a practical exam with a 7 hours 30 minutes time limit. The voucher includes 1 free retake, and you need at least 60% to pass. Scoring above 75% earns a "with merit" distinction on your certificate.

The exam includes both MCQ and open-answer questions. The MCQ portion is only around 5–10% of the exam, and even those are practical rather than theory: you can't guess your way through them.

Now that you know the format, let's get into the exam experience.

I purchased the exam on Friday (16 Jan) with the intention of sitting it on Saturday (17 Jan). I was tired from work and had two other blue team exams planned for the same month, so I wanted to get this done in one go, but it didn't go as planned. I ran into a technical issue from the start.

The exam requires a VPN connection. Once you start, their firewall applies rules to allow access to the exam machines, but there's a catch: you need to wait around 8–10 minutes, then reconnect to the same VPN before the machines become reachable. The first machine is an Ubuntu host running Splunk, and the second is a Windows VM for disk and malware analysis.

The exam also gives you a situation brief (effectively a letter of engagement), which, combined with the questions on the platform, tells you exactly what you're investigating.

I started with Splunk since it lets you cut across multiple hosts and log sources quickly. I was able to answer 30–40% of the questions from the SIEM alone. But when I tried to reach the Windows VM for malware reverse engineering and disk analysis, it was completely unresponsive. This led directly to my failed attempt: 30–40% correct is well below the 60% passing threshold.

I reached out to The SecOps Group via email and received only an automated FAQ response about reconnecting the VPN, which wasn't my issue at all. The SIEM machine was fine; it was the Windows VM that was dead. I also realised I had taken the exam on a Saturday, outside their working hours, so there was no live support available. I gave up, submitted what I had, and posted about it on LinkedIn.

I had a community gathering to attend that day (a party for the Thailand Blue Team Community after the Thailand Women Top Talent 2025 Qualifier), and at that point I was ready to write the whole thing off. Then Sumit Siddharth, CEO of The SecOps Group, sent me a direct message on LinkedIn saying they were looking into the issue. Within minutes, they traced it to an AWS error that had stopped the instance from booting.

To compensate me, they gave me one extra attempt: effectively giving me 2 full attempts plus the original retake. I was genuinely impressed that they cared enough to track down the root cause and reach out personally. I told them I'd try again the next day (Sunday), which brings us to Round 2.

Sunday morning. Mild headache from the after-party the night before, but I remembered exactly where I'd left off. Since I'd already worked through the Splunk questions, all that remained was the malware analysis and disk analysis, and this time, I could finally RDP into the Windows VM.

Everything went smoothly for a while and I picked up answers fairly quickly, until I hit two questions I got stuck on. One involved a rabbit hole I'd fallen into by not reviewing all the evidence carefully enough. The other required malware reverse engineering in IDA, which carries the most weight of any single question on the exam and is my weakest area. I thought I understood the logic, but in the end my analysis didn't produce a useful result.

By the time Monday was approaching (I had another exam and work the next day), I decided to submit without answering the last question, accepting that I might not hit "with merit."

To my surprise, I passed with merit. I'm fairly confident I answered every other question correctly and only left one blank, though it looks like one answer was also wrong (I still don't know which). As you can see, I spent 343 minutes on this attempt: I wrapped up everything else in the first 3–4 hours and spent the remainder on that last question.

It ended well, and I still had enough mental energy left to prepare for Monday's exam.

The CEO of The SecOps Group messaged me again on Sunday to check if I'd had any further issues. I replied once I'd finished the exam and shared a short review on LinkedIn. My honest take: the exam is great, using knowledge across multiple domains in a single investigation is always a solid design choice, and they nailed it. That said, I wouldn't recommend this to a SOC L1 analyst. But if you're confident in your skills and want a genuine challenge, go for it while the 90% discount is still available.

That's it, good luck to everyone going for this exam. It's not that hard, but you need a solid logical foundation to understand what the attacker was really after and how the incident unfolded.

Peace ✌️