CREST CRT Practice Test
Prepare for the CREST Registered Penetration Tester exam with free practice tests covering the full CRT syllabus. Each test has 20 questions built around the practical skills and knowledge assessed in both the Infrastructure and Web Application stages of the real CRT exam.
Mixed Set — CREST CRT Practice Tests
Questions distributed across all CRT practical assessment areas — Networks, Desktop Lockdown, Vulnerability Assessment, Simple Exploitation, Routing Manipulation, and Web Application testing. Each test mirrors the technical knowledge and methodology expected in the real CREST CRT exam.
Domain Wise — CREST CRT Mock Tests
Target each practical assessment area of the CRT exam with focused domain tests. The CRT is divided into an Infrastructure stage and a Web Application stage — use these mock tests to build depth in the specific areas the exam will assess hands-on.
About the CREST CRT Certification Exam
Everything you need to know about the CREST Registered Penetration Tester exam — what it tests, who it's designed for, and why it matters for your penetration testing career.
What Is the CREST CRT?
The CREST Registered Penetration Tester (CRT) is an intermediate-level practical certification from CREST (Council of Registered Ethical Security Testers) that validates a candidate's hands-on ability to conduct real-world penetration testing engagements. Unlike the theory-based CPSA, the CRT is a fully practical exam — candidates work against a live network environment using professional tools to identify, exploit, and document vulnerabilities across infrastructure and web applications.
The CRT is formally recognized by the UK National Cyber Security Centre (NCSC) for its CHECK scheme, meaning CRT holders meet the minimum standard required to serve as a CHECK Team Member on UK government penetration testing engagements. It is widely considered the benchmark entry point for professional pentesters in the UK, Australia, the Middle East, and Southeast Asia. CRT-certified professionals are positioned for roles such as Penetration Tester, Security Consultant, and Vulnerability Analyst, with typical salaries ranging from £45,000 to £75,000 in the UK and comparable rates internationally. The certification is valid for 3 years and serves as a prerequisite for advanced CREST credentials including the CCT Infrastructure and CCT Web Application certifications.
Exam Format (2026)
Testing method: Practical assessment delivered at Pearson VUE test centres. Candidates work on a provided Kali Linux virtual machine — personal laptops and devices are not permitted.
Duration: 2.5 hours plus 15 minutes of reading time before the exam begins.
Question types: Mix of flags (retrieved values from target systems), short-form answers, and multiple-choice questions. Copy and paste from Kali into the answer sheet is disabled — answers must be typed manually.
Scoring: 160 total marks split across two stages — Infrastructure (100 marks) and Web Application (60 marks). Candidates must achieve at least 60% in each stage independently to pass.
Tools available: Burp Suite Professional and Nessus Professional are fully licensed within the Pearson VUE exam environment.
Exam fee: Approximately £275 + VAT (around $400–$450 USD) via Pearson VUE.
Eligibility Requirements
Prerequisite: A valid CREST Practitioner Security Analyst (CPSA) certification is mandatory before booking the CRT exam. There are no exceptions to this requirement for the standard exam route.
Equivalency route: Candidates holding a valid OSCP (within the last 3 years) plus a valid CPSA may apply for CRT by equivalency without sitting the practical exam. Note: this route is not accepted for NCSC CHECK Team Member or UK Cyber Security Council purposes — the full exam must be sat for those pathways.
Recommended experience: CREST positions CRT as indicative of approximately 3 years of hands-on penetration testing experience. Candidates should have practical familiarity with Kali Linux, Burp Suite, Nessus, and common pentest workflows.
Retake policy: Unsuccessful candidates must wait a minimum of 8 weeks before retaking the CRT exam.
Certification validity: 3 years from the date of passing.
CREST CRT Exam Stages — Assessment Coverage
The CRT practical exam is divided into two scored stages. You must achieve at least 60% in each stage independently — a strong web application performance cannot compensate for a weak infrastructure score, or vice versa.
| Stage | Assessment Area | Marks |
|---|---|---|
| Infrastructure | Networks — Host/service discovery, enumeration, DNS analysis | ~20 pts |
| Infrastructure | Routing Manipulation — Routers, switches, ARP/VLAN attacks | ~20 pts |
| Infrastructure | Vulnerability Assessment — Scanner use, output interpretation | ~20 pts |
| Infrastructure | Simple Exploitation — Known CVEs, credential attacks, post-exploitation | ~20 pts |
| Infrastructure | Desktop Lockdown — Locked Windows/Citrix breakout, privilege escalation | ~20 pts |
| Web Application | Web Application — Recon, auth, injection, sessions, logic flaws, Burp Suite | 60 pts |
How Our Practice Tests Are Designed
Knowledge-first approach to a practical exam — The CRT is a hands-on exam, but passing it requires deep conceptual knowledge of what tools do, how exploits work, and why vulnerabilities exist. Our practice tests target this foundational knowledge layer — the understanding that makes the difference between running a scan and actually interpreting its output under exam conditions.
Coverage mapped to both exam stages — Mixed practice tests draw questions proportionally from both the Infrastructure stage areas (Networks, Routing Manipulation, Vulnerability Assessment, Simple Exploitation, Desktop Lockdown) and the Web Application stage. This reflects the CRT's 100/60 mark split, giving infrastructure topics slightly more representation across the test set.
Proportional timer — The real CRT exam provides 2.5 hours (150 minutes) plus 15 minutes of reading time for a 160-mark practical. Our 20-question practice tests run at 25 minutes — calibrated to develop the methodical, time-aware mindset essential in the actual exam environment.
Targeted domain tests for weak spots — Use the individual domain tests to identify and strengthen specific areas. Routing Manipulation and Networks are newer additions to the CRT syllabus flagged by CREST itself — domain-wise tests let you give these areas dedicated attention before exam day.
CREST CRT Exam Preparation Tips
Study Strategy
Build a lab environment: The CRT is practical — reading alone is not enough. Set up local virtual machines with vulnerable targets (Metasploitable, DVWA, Windows Server VMs) and practice running full pentest workflows. Simulate a no-internet, no-copy-paste environment as early as possible.
Master your tools thoroughly: Burp Suite Professional and Nessus Professional are provided in the exam environment and are central to passing. Practice their core workflows — Burp's interceptor, Repeater, Intruder, and Decoder; Nessus scan configuration and output analysis — until they are second nature.
Study both stages equally: Many candidates over-prepare for web application testing and underestimate infrastructure. Both stages have independent 60% pass thresholds. Neglecting Routing Manipulation or Vulnerability Assessment can cause a fail even with a strong web application performance.
Test-Taking Strategy
Use the reading time wisely: The 15 minutes of reading time before the exam clock starts is valuable. Scan the full task list, identify quick wins, and plan your sequencing before touching the keyboard. Starting with high-confidence sections builds a mark buffer early.
Score per minute — not perfection: If you stall on a task, set a mental 5-minute limit and move on. Returning with fresh eyes is more productive than sinking time into a single blocked step. Partial marks across more tasks often outperform full marks on a smaller number.
Type carefully, capture evidence early: Copy and paste from Kali to the answer sheet is disabled in the CRT exam. Transcribe flags and short answers slowly and accurately — a typo on a correct flag scores zero. When you find a vulnerability or gain access, capture your evidence immediately rather than relying on memory.
Frequently Asked Questions
Ready to Test Your CREST CRT Knowledge?
Start with a mixed set to assess your coverage across all practical exam areas, then use domain tests to sharpen the specific stages where you need the most work.
Start CREST CRT Practice Test 1 →
