CREST Certification
Practice Tests
Free practice tests for CREST CPSA, CRT, CCT INF, CCT APP, CCSAM, and CCRTS. The complete CREST pathway from entry-level analyst through expert red team specialist — all in one place. No sign-up required.
The CREST Certification Pathway
CREST certifications form a defined career ladder from practitioner entry point through advanced and expert credentials — each building directly on the one below it.
CREST Certifications Compared
The CREST pathway runs from entry-level written exam to expert multi-component assessments. Each level has distinct requirements, formats, and career outcomes.
| Cert | Level | Format | Pass Score | Prerequisites | CHECK Status | Validity |
|---|---|---|---|---|---|---|
| CPSA | Entry | 120 MCQ, 2 hrs, closed-book | 60% (72/120) | None | None (gateway to CRT) | 3 years |
| CRT | Intermediate | Practical: Infra + Web App, 2.5 hrs | 60% each stage | CPSA required | Team Member | 3 years |
| CCT INF | Advanced | MCQ + Scenario + Practical, 3 components | 66% each component | None (CRT recommended) | Team Leader | 3 years |
| CCT APP | Advanced | MCQ + Scenario + Practical, 3 components | 66% each component | None (CRT recommended) | Team Leader | 3 years |
| CCSAM | Expert | SAM 1 + SAM 2, written only | 70% each part | None (senior experience expected) | N/A (management) | 3 years |
| CCRTS | Expert | MCQ + Scenario + Red Team Assault Course | 66% each component | None (CCT INF recommended) | CBEST/TIBER-EU | 3 years |
About CREST Certifications
CREST is the international accreditation and certification body for the cybersecurity industry, with a particular focus on penetration testing and red teaming.
What is CREST?
CREST (Council of Registered Ethical Security Testers) is a not-for-profit international accreditation body that certifies individuals and organisations in penetration testing, red teaming, threat intelligence, and security operations. CREST certifications are recognized by the UK National Cyber Security Centre (NCSC) and are required for government CHECK scheme penetration testing engagements in the UK.
CREST credentials are widely recognized across the UK, Australia, Southeast Asia, Middle East, and internationally. The CCRTS is specifically required for regulated red team engagements under the Bank of England's CBEST framework and the ECB's TIBER-EU programme.
Which CREST Certification Should You Pursue?
Start with CPSA if you are entering penetration testing and need the gateway credential to CRT. 6–12 months of technical IT experience recommended.
Take CRT after CPSA to earn hands-on practitioner status and NCSC CHECK Team Member recognition. Requires ~3 years of experience in practice.
Pursue CCT INF or CCT APP to reach senior level. CCT INF is for infrastructure specialists; CCT APP for web application experts. Both require ~5–6 years of experience and confer CHECK Team Leader status.
Target CCSAM if you lead red team engagements and need to demonstrate management-level expertise across the full simulated attack lifecycle.
Target CCRTS if you are a red team specialist delivering adversary simulation engagements, particularly in regulated financial sector environments under CBEST or TIBER-EU.
Frequently Asked Questions
Common questions about CREST certifications and these free practice tests.
