CREST CCT INF Practice Test
Prepare for the CREST Certified Tester — Infrastructure exam with free practice tests covering all five major syllabus areas. Each test has 20 questions timed at 1 minute per question to match the pace of the real CCT INF written exam.
Mixed Set — CREST CCT INF Practice Tests
Questions distributed across all five CCT INF syllabus areas according to the official CREST exam blueprint. Advanced topics such as Infrastructure and Network Security, Modern Environments, and Reconnaissance feature heavily — reflecting the depth expected from candidates with 5 to 6 years of hands-on experience.
Domain Wise — CREST CCT INF Mock Tests
Target each CCT INF syllabus area with focused domain tests. The updated CCT INF syllabus includes expanded coverage of cloud, containerisation, macOS, social engineering, and global law and compliance — use these mock tests to build depth across the full breadth of the exam.
About the CREST CCT INF Certification Exam
Everything you need to know about the CREST Certified Tester — Infrastructure exam, including its three-component structure, what distinguishes it from CRT, and why it matters for senior penetration testing careers.
What Is the CREST CCT INF?
The CREST Certified Tester — Infrastructure (CCT INF) is an advanced-level certification from CREST that validates a practitioner's ability to conduct comprehensive infrastructure penetration testing engagements at an expert level. It is positioned above the CRT in the CREST certification pathway and is aimed at professionals with approximately 5 to 6 years of hands-on infrastructure security experience. The CCT INF tests a much broader and deeper syllabus than the CRT, with updated coverage including cloud services (AWS, Azure, GCP), containerisation (Docker, Kubernetes), macOS security, social engineering, and expanded law and compliance requirements.
The CCT INF is recognised by the UK National Cyber Security Centre (NCSC) for its CHECK scheme, where CCT-level holders qualify for CHECK Team Leader status — a significant step above the Team Member status conferred by CRT. This makes the CCT INF essential for professionals who lead penetration testing engagements on UK government and critical national infrastructure systems. CCT INF-certified professionals typically earn between £65,000 and £100,000+ in the UK, with strong demand from government security teams, financial institutions, and specialist security consultancies. The certification has no formal prerequisites, though a valid CRT is the natural progression point.
Exam Format (2026)
Components: Three separate assessment stages — a multiple-choice written exam, a written scenario, and a practical assessment.
Written exam: 60 multiple-choice questions completed in 2.5 hours (1 minute per question) at a Pearson VUE test centre. Closed book — no notes, internet, or devices permitted.
Written scenario: A risk analysis and report-writing exercise where candidates document findings for a defined audience. Tests professional communication alongside technical depth.
Practical assessment: Hands-on penetration testing against reference networks using a provided Kali Linux environment (candidates cannot use their own laptops). Duration is 3 hours plus 20 minutes of reading time.
Passing score: At least 66% (two-thirds) must be achieved in each component independently. Passing one component but failing another results in an overall fail.
Exam fee: Approximately $400 USD (varies by region). Check Pearson VUE for current pricing.
Eligibility Requirements
Prerequisites: There are no formal prerequisites for the CCT INF exam — any candidate can book and sit it. However, the exam is calibrated to approximately 5 to 6 years of hands-on infrastructure penetration testing experience.
Recommended background: A strong foundation in Windows and Linux security assessment, Active Directory exploitation, network attack techniques, and web technology enumeration is essential. Familiarity with cloud environments and containerisation platforms is increasingly important given recent syllabus updates.
Natural progression: Most candidates hold CRT certification before attempting CCT INF. The CRT covers a subset of the CCT INF syllabus and provides the practical baseline expected at this level.
CHECK Team Leader: Passing CCT INF (subject to NCSC approval) confers CHECK Team Leader status, enabling professionals to lead government-mandated penetration testing engagements.
Certification validity: 3 years. Renewal requires re-examination.
CREST CCT INF Syllabus Areas — Exam Coverage
The revised CCT INF syllabus spans five broad domain groupings. All three exam components — the multiple-choice written exam, written scenario, and practical assessment — draw from these areas, with different components testing different depth levels.
| Domain | Topic | Coverage |
|---|---|---|
| Areas A & B | Assessment Management, Methodology, and Core Skills | High |
| Areas C, D & E | Infrastructure, Network, and Platform Security | Very High |
| Areas F & G | Modern Environments and Enterprise Technologies | High |
| Areas H & I | Reconnaissance and Web Technologies | Moderate |
| Areas K & N | Human and Physical Security | Moderate |
How Our Practice Tests Are Designed
Written exam focus with scenario-level depth — Our practice tests are built to prepare candidates for the CCT INF multiple-choice written component, where 60 scenario-based questions must be answered in 60 minutes. Questions require applied, analytical thinking — not just recall — reflecting the advanced level of knowledge expected at CCT grade.
Full syllabus breadth including new areas — The CCT INF syllabus was significantly updated to include cloud security, containerisation, macOS, social engineering, network intrusion protection bypass, Unix exploitation, NoSQL injection, and expanded global law and compliance. Our practice tests cover all five domain groupings including these newer additions that earlier study resources may not address.
Proportional timer — The real CCT INF multiple-choice exam gives exactly 1 minute per question across 60 questions (2.5 hours total). Each 20-question practice test is timed at 20 minutes, building the pace discipline required to answer under strict time pressure across a very broad and technically demanding syllabus.
Domain tests for the hardest areas — Modern Environments (cloud, containers, macOS) and Infrastructure/Network Security are the most technically dense domains in the updated syllabus. Use the domain-wise tests to build concentrated depth in these areas before moving to mixed-set practice.
CREST CCT INF Exam Preparation Tips
Study Strategy
Study the revised syllabus thoroughly: The updated CCT INF syllabus added meaningful new areas — cloud services, containerisation, macOS, social engineering, hardware security, and expanded law and compliance. Candidates using older study materials will have significant coverage gaps. Start with the current official CREST syllabus PDF as your definitive guide.
Prepare all three components simultaneously: The written exam, written scenario, and practical assessment all require different preparation modes. Passing the MCQ component without passing the scenario or practical still results in a fail. Dedicate dedicated study time to report writing and scenario analysis, not just technical depth.
Prioritise breadth over depth on the written exam: The 60-question MCQ tests the entire syllabus width in 60 minutes. A question on macOS exploitation may follow one on Kerberos delegation. Broad, consistent coverage across all five domain groups consistently outperforms deep specialisation in a subset of areas.
Test-Taking Strategy
Flag and move on: The CCT INF written exam officially recommends flagging uncertain questions and returning to them — do not spend more than 60 seconds on any single question. Banking marks from high-confidence questions before revisiting flagged ones is the most reliable pacing strategy.
Anchor scenario answers in evidence: The written scenario component rewards structured, evidence-based answers over volume. Read the scenario introductory section carefully, identify the intended audience, and communicate findings clearly to that audience — a technical report for a security team differs substantially from a management summary.
Use reading time in the practical: The 20 minutes of reading time before the practical clock starts is strategically critical at CCT level. Scan the full task list, identify high-value and high-confidence tasks, and sequence your work to build a mark buffer before tackling the more complex chains.
Frequently Asked Questions
Ready to Test Your CREST CCT INF Knowledge?
Start with a mixed set to assess your readiness across all syllabus areas, then use domain-wise tests to build depth in the most technically demanding sections.
Start CREST CCT INF Practice Test 1 →
