What I like best is that the challenges feel like actual work, not exercises. When I sat the FOR500 and FOR585 Capstones, I was doing the same kind of triage I do at my current and previous roles, just compressed into a few intense hours. The scenarios are curated by instructors who have obviously investigated real incidents, and it shows in the fidelity of the artifacts and the pacing of the story. The other thing I appreciate is that the ranges give you an honest measure of where you actually are, which is rare in this field. Review collected by and hosted on G2.com.

The one that comes to mind is how little you can review after the fact. During the range you are in the thick of it, and the debrief is often light on what the intended path was or what most people missed. I finish some scenarios wanting a proper writeup or annotated walkthrough to compare against my own approach, and that is not always available, unless with On-Demand access. I would also love more coverage of modern cloud investigations and SaaS attack paths, since a lot of what I actually see at my current and previous roles sits in that space, and the ranges still lean heavier toward traditional Windows enterprise scenarios. Neither is a dealbreaker, but they are the two things I would most want to see change. Review collected by and hosted on G2.com.