1.2 24-Hour Window, Check-In, and Delivery
Key Takeaways
- The 24-hour exam timer starts when you start the exam and runs continuously; all three sections must be finished inside that window, in order.
- TryHackMe states there is no proctoring: you complete the exam without supervision, which is not permission to ignore the legal agreement or use extra devices.
- Check-in includes identity verification, a legal agreement, and an exam introductory video; Onfido ID verification can be done in the app or browser and review can take up to 48 hours.
- Supported browsers in TryHackMe’s SAL1 technical article are Chrome and Firefox; use a stable internet connection.
- Avoid VPNs during Onfido verification, and do not sit the exam in multiple browser tabs or on multiple devices at the same time.
The 24-Hour Clock Is Continuous
TryHackMe’s format article (23 Feb 2025) is blunt: the exam has a 24-hour timer that starts when you start the exam. All three sections must be completed within 24 hours of that start. The timer runs continuously once started. Sections must be completed in order.
That combination surprises people who have sat other vendor exams. Many knowledge tests pause when you submit a section, or they let you book a two-hour slot with a human proctor and then go home. SAL1 is different. When you click start, you have opened a day-long container. Sleep, meals, work meetings, and “I’ll do the second sim tomorrow morning” all still consume the same clock.
Section limits versus the overall window
Keep two clocks in your head:
| Clock | What it limits | What it does not do |
|---|---|---|
| 24-hour exam timer | The entire sitting, from start to last submit | It does not pause between sections or overnight |
| MCQ 1-hour limit | Only the 80-question paper | Unused minutes do not move into a simulator |
| Each SOC Sim 2-hour limit | Only that scenario | Unused minutes do not move into the other sim |
The section times add to five hours of active work (1 + 2 + 2). The other 19 hours in the window are slack for breaks, meals, and recovery — not a second attempt at a section you already submitted, and not a way to start scenario 2 before scenario 1.
Plan the sitting so you can actually use that slack. Starting at 10 p.m. because you “have 24 hours” is a poor plan if you will be exhausted during the second simulator. Starting when you have a quiet block for the MCQ plus both sims, with sleep between sections if you want it, is the point of the long window.
Order is mandatory
You complete:
- The multiple-choice section
- SOC Simulator scenario 1
- SOC Simulator scenario 2
You cannot jump to a simulator to “get the hard part done first.” You cannot skip a scenario and come back. Build a personal runbook: MCQ technique (section 1.4), then the simulator workflow you will learn in Chapter 2, then the same simulator workflow again on a fresh scenario.
Check-In Happens in Two Layers
The format article lists a check-in process that includes:
- ID verification
- A legal agreement
- An exam introductory video
The Onfido article (25 Feb 2025) adds the operational detail that matters for your calendar: Onfido ID verification is required to confirm your identity before taking the exam. You can complete it via the Onfido app or directly in your browser. Follow the on-screen instructions. If verification is under review, TryHackMe says the team will process it within 48 hours, and you receive an update when it is complete.
Do Onfido early
Treat identity verification as a pre-exam gate, not as something you start 20 minutes before you wanted to open the 24-hour window. A review that takes most of two days will destroy a weekend sitting you booked in your head. Complete Onfido while you still have study days left. Keep a clear, valid identity document ready. Enable camera and microphone permissions. Use a stable internet connection.
TryHackMe’s SAL1 technical-issues article (19 May 2025) is explicit about VPNs during this step: avoid VPNs while you verify. If Onfido fails, try switching between the browser and the mobile app, then contact support if it remains pending. Do not assume a VPN “privacy setup” that you use for lab work is harmless here; it is a published failure mode for ID verification.
Legal agreement and intro video
After identity is in good standing, expect a legal agreement and an exam introductory video as part of check-in. Watch the video. It is not optional flavour. The agreement is the rule set you are scoring under. Unsupervised delivery (below) does not cancel that agreement.
No Proctoring Does Not Mean No Rules
TryHackMe’s additional format notes say no proctoring — candidates complete the exam without supervision. Do not describe SAL1 as a proctored exam. There is no published requirement to sit in view of a webcam invigilator for the full 24 hours.
Unsupervised is not the same as unrestricted. You still complete identity verification. You still accept a legal agreement. You still have a single exam sitting with a continuous timer. Using extra devices, extra tabs, or a second person “just to help with the sim” is not a clever reading of “no proctoring.” It is a way to fail the rules you just agreed to.
Think of it as a take-home professional exam with a locked section order and published technical constraints, not as an open-book group project.
Delivery Environment
Supported browsers
TryHackMe’s SAL1 technical-issues article lists Chrome and Firefox as the supported browsers if the interface freezes or crashes. Do not discover on exam day that your daily Safari or Edge setup is a poor match for a sitting that already forbids a second device. Install a current Chrome or Firefox build, disable unnecessary extensions, and confirm you can log in before you start the 24-hour clock.
If the exam becomes unresponsive, the published first moves are: refresh, clear cache, confirm you are on a supported browser, disable extra extensions, and restart the device if needed. If you still cannot continue, contact TryHackMe support with screenshots. That is a support path, not a promise of extra time — which is why a dry run of the browser environment is cheaper than a mid-sim crash.
Stable internet, one tab, one device
The format article tells you to ensure a stable internet connection before starting. The technical-issues article repeats that for timer and progress problems, and it adds a delivery rule candidates break by accident: avoid multiple browser tabs or devices logged into the exam at the same time.
Practical setup:
- Use a wired connection or a quiet, strong Wi-Fi network you control
- Pause OS updates, cloud-backup storms, and large downloads
- Close extra TryHackMe tabs; do not “preview” the exam on your phone while a laptop session is live
- Do not bounce between a desktop and a tablet hoping one will be faster
- Keep your power cable in; a 24-hour window is long enough for a laptop to die during a simulator
A second window for your own notes is a judgement call against the “multiple tabs” warning. The published failure mode is multiple tabs or devices logged into the exam. Do not run two exam sessions. If you keep a local notes file, keep it outside the exam login.
What to stage the day before
- Onfido already approved, not still in a 48-hour review
- Chrome or Firefox tested, extensions trimmed
- Identity document still available if support asks you to retry verification
- A calendar block that covers the MCQ plus both two-hour sims, with optional sleep between sections inside the same 24 hours
- A decision about when you will click Start — because that click starts a clock you cannot pause
How to Think About Breaks
You may take breaks between sections because the overall window is 24 hours. You may not take a break that causes a section timer to expire. If you walk away for 70 minutes during the MCQ, that section is gone. If you walk away for 130 minutes during a simulator, that scenario is gone. Chapter 2 covers TryHackMe’s published warning about what a timeout does to a simulator section; for this chapter, the operational rule is simpler: stay present for each section’s own clock.
A sensible personal plan for many candidates is:
- Morning: start, finish check-in leftovers, sit the 60-minute MCQ while you are fresh
- Short break (food, walk) while the 24-hour clock continues
- Sit simulator 1 for up to two hours
- Longer recovery break
- Sit simulator 2 for up to two hours
That still finishes in a single waking day with margin. If you must split overnight, split between sections, never inside one.
Official Starting Points
- Format and timings (23 Feb 2025): Exam Format and Timings
- Onfido (25 Feb 2025): Onfido ID Verification
- Technical issues / SAL1 (19 May 2025): General Technical Issues
If those pages change after 2026-09-19, follow TryHackMe, not a remembered blog paraphrase.
When does the SAL1 24-hour exam timer start, and does it pause between sections?
You want to sit SAL1 this Saturday morning. Your Onfido verification is still “under review.” What published time bound should you plan around?
Which delivery setup matches TryHackMe’s published SAL1 guidance?