Prove you can work an intrusion on your own.
This is the Cover6 checkpoint for incident responders. You work a multi-stage intrusion in Splunk on your own, on a 72-hour clock. Pass, and you have proof you can do the work.
$299 includes one attempt and one retake, a Splunk lab login, and scoring against a published rubric.
Who it’s for
Anyone can take it. The Incident Response course is the natural preparation.
What’s included
- A lab login for one of 12 seeded incidents
- 60 questions that only your incident data can answer
- An incident report with two detections and an after-action review
- A 30-minute written defense of your work
- One attempt and one retake
How it works
The 72 hours start when you press Start my 72 hours, after you accept the challenge rules. They never start at purchase, and the clock doesn’t pause once it starts. Your work is scored against a published rubric. Pass and you earn a certificate with 10 CPE hours, recorded at cover6solutions.com/verify. If you need more tries after your included retake, further retakes are $99.
Aligned with DoD 8140 work role 531 (Cyber Defense Incident Responder). We make no job, interview or exam-pass promises. The challenge shows what you can do.
What comes next
Want the course too? The Incident Response + Cover6 IR Challenge Bundle is $599, $99 less than buying both. Ready now? Add the challenge to your cart and check out.


