CREST CCRTS Practice Test
Prepare for the CREST Certified Red Team Specialist exam with free practice tests aligned to the official CCRTS syllabus v2.1. Each test delivers 20 scenario-driven questions timed at 1 minute per question — matching the pace of the real CCRTS written multiple-choice component so you develop exam-ready speed and confidence.
Mixed Set — CCRTS Practice Tests
Questions distributed across all 8 CCRTS syllabus domains according to their depth in the official CREST exam blueprint. Operationally heavy domains like Initial Access, Lateral Movement, and Evasion appear with greater frequency — closely mirroring the distribution of the real written multiple-choice exam.
Domain Wise — CCRTS Mock Tests
Sharpen your knowledge across each of the eight CCRTS syllabus domains with targeted 20-question mock tests. Each test isolates a single knowledge group from the official CREST syllabus so you can identify and close gaps before sitting any component of the real exam.
About the CCRTS Certification Exam
Everything you need to know about the CREST Certified Red Team Specialist exam structure, eligibility, career value, and how it compares to other red team credentials.
What Is the CREST CCRTS?
The CREST Certified Red Team Specialist (CCRTS) is an advanced-level certification issued by CREST, the international not-for-profit accreditation and certification body for the cybersecurity industry. The CCRTS validates a professional's ability to plan, lead, and execute full-scope adversary simulation engagements — including intelligence-led red team operations informed by real threat actor TTPs (tactics, techniques, and procedures). The exam was previously known as the CREST Certified Simulated Attack Specialist (CCSAS) before being renamed to align with current industry terminology.
The CCRTS holds significant regulatory standing. It is a mandated requirement for red team operators delivering assessments under the Bank of England's CBEST framework, the ECB's TIBER-EU programme for European financial institutions, and several other government-recognised frameworks globally. Professionals holding the CCRTS work in roles such as Red Team Lead, Adversary Simulation Specialist, Offensive Security Consultant, and Principal Penetration Tester. Salaries for CCRTS-qualified professionals in the United Kingdom typically range from £75,000 to £130,000 depending on seniority, with consultants in regulated financial sector engagements often commanding premium rates.
Exam Format (2026)
Exam components: The CCRTS consists of three separate components — a written multiple-choice test, a written scenario section, and a practical exam.
Written MCQ: 60 multiple-choice questions with five answer options each, delivered in 60 minutes. Closed book — no notes, internet access, or electronic devices permitted.
Written scenario: Structured around engagement stages including scoping, risk management, and tradecraft. Candidates receive a Threat Intelligence pack as contextual input.
Practical exam: Two components — a Red Team Assault Course (targeting ≥120 of 180 marks) and a Red Team Tactics, Tradecraft and Operational Security section (targeting ≥60 marks). Candidates may pre-upload tools via CRESTDrive.
Passing requirement: All three components must be passed. Passing one but failing another results in overall failure.
Syllabus version: v2.1, issued November 2024 by the CREST Technical Committee and Assessors Panel.
Eligibility Requirements
Prerequisites: There are no formal prerequisites for the CCRTS exam. CREST recommends, but does not require, that candidates have passed the CREST Certified Tester (Infrastructure) — CCT Inf — examination beforehand.
Recommended experience: The CCRTS is an advanced-level exam. Candidates should have substantial hands-on experience leading red team or adversary simulation engagements, not just penetration testing. A background in post-exploitation, C2 operations, and evasion is essential for the practical components.
Regulatory frameworks: Candidates seeking CBEST or TIBER-EU delivery status through their employer will typically need to hold the CCRTS or an accepted equivalent qualification.
Certification validity: CREST certifications are valid for three years, after which recertification is required to maintain active status.
CCRTS Syllabus Domain Coverage — v2.1 Exam Outline
The CCRTS syllabus is divided into eight knowledge groups (Appendices A through H). Each domain is assessed across the written multiple-choice, written scenario, and practical components — though not every skill area appears in all three. The coverage estimates below reflect the relative depth and breadth of each domain within the official syllabus.
| Domain | Knowledge Group | Coverage |
|---|---|---|
| Appendix A | Soft Skills and Assessment Management | 10% |
| Appendix B | Core Technical Skills | 12% |
| Appendix C | Reconnaissance | 12% |
| Appendix D | Implants | 12% |
| Appendix E | Initial Access | 14% |
| Appendix F | Lateral Movement & Privilege Escalation | 16% |
| Appendix G | Evasion | 14% |
| Appendix H | Egress / Command and Control | 10% |
How Our Practice Tests Are Designed
Scenario-driven question style — The CCRTS written multiple-choice section tests your ability to make tactical decisions under realistic adversary simulation conditions, not just recall facts. Our questions present operational scenarios — a detection event, a misconfigured ACL, a C2 beaconing decision — and ask you to choose the most appropriate red team response, just as the real exam does.
Syllabus-aligned mixed sets — Mixed practice tests distribute questions across all eight CCRTS knowledge groups proportionally, with heavier coverage of the more operationally complex domains like Lateral Movement and Privilege Escalation, Evasion, and Initial Access — matching the depth of these domains in the official CREST syllabus v2.1.
Proportional timer — The real CCRTS written MCQ component allows 60 minutes for 60 questions — exactly 1 minute per question. Every 20-question test on this site is timed at 20 minutes to match that pace precisely and train you to make fast, confident decisions under time pressure.
Domain-specific mock tests — The eight domain-wise tests let you isolate and drill individual knowledge groups. Use these to reinforce weaker areas identified through your mixed-set results, or to build depth in domains that also appear in the written scenario and practical components.
CCRTS Exam Preparation Tips
Study Strategy
Read the official syllabus in full: The CREST CCRTS syllabus v2.1 maps every skill area to one or more exam components. Use this document as your preparation roadmap — identify which areas appear in the MCQ only vs. those that also appear in the scenario and practical components, and prioritise accordingly.
Think like a red team lead, not a pentester: The CCRTS assesses engagement leadership as much as technical execution. Be ready for questions on scoping, legal constraints, rules of engagement, risk decisions during live operations, and how to contextualise your work within CBEST or TIBER-EU frameworks.
Build genuine practical depth: The practical exam component — particularly the Red Team Assault Course — cannot be passed on theory alone. Invest time building, deploying, and operating real C2 infrastructure, developing custom implants, and practising evasion against modern EDR solutions in a lab environment.
Test-Taking Strategy
Budget exactly 1 minute per question: With 60 MCQ questions in 60 minutes and five answer options per question, there is no margin for extended deliberation. Our 20-minute timed tests build exactly this habit. Eliminate obviously wrong options first, then commit to the most operationally sound answer for the given scenario.
Use the TI pack in the written scenario: The written scenario section provides a Threat Intelligence pack for context. Take time to absorb the TI pack before answering — the scoping and risk management questions in particular require you to integrate the threat context into your decisions, not answer generically.
All three components must pass independently: Do not deprioritise the practical exam while focusing on the written components. The CCRTS requires all sections to pass simultaneously — excelling in the MCQ does not compensate for a failed practical. Allocate preparation time across all three components.
Frequently Asked Questions
Ready to Test Your CCRTS Knowledge?
Start with a mixed set to benchmark your current level across all eight domains, then use the domain-specific tests to close gaps before your exam date.
Start CCRTS Practice Test 1 →
