CREST CPSA
CREST Practitioner Security Analyst (CPSA)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The CREST Practitioner Security Analyst (CPSA) is an entry-level certification that tests a candidate's knowledge of assessing operating systems and common network services, together with an intermediate level of web application security testing. It is aimed at people moving into hands-on penetration testing roles: CREST describes successful candidates as qualified for hands-on pen test roles, indicative of around two years of experience. The syllabus spans soft skills and assessment management, core technical skills (including cryptography), background information gathering and open source, networking equipment, Microsoft Windows and Unix security assessment, web testing methodologies and techniques, and databases. The exam has a single component: a closed-book, multiple-choice written paper delivered at a Pearson VUE centre of your choice. There are no pre-requisites, although a valid CPSA is itself the pre-requisite for the CRT. Preparation is self-directed: CREST publishes a full syllabus, notes for candidates, sample questions and a recommended reading list, and has partnered with a number of training providers whose courses cover the syllabus topic areas. Candidates should read the syllabus and notes carefully, work through the sample questions to understand the exam's wording and structure, and confirm booking and accommodation arrangements with Pearson VUE and CREST support in good time.
What you'll study
About CREST CPSA preparation
What is the CPSA exam format?
It is a single written component made up of 120 multiple-choice questions, all of which you must complete. Each answer is worth one mark and no points are deducted for incorrect answers, so the paper is marked out of 120. It is a closed-book exam: no books, written notes, internet access or other electronic devices are allowed.
How long do I have, and how long is the session?
The examination itself lasts 2 hours. Note that your permitted maximum session time at the Pearson VUE test centre is 2.5 hours in total, so allow for check-in and administration beyond the paper itself. Plan your pace across 120 questions accordingly rather than assuming the full session is answering time.
What score do I need to pass?
Successful candidates must score 60% of the available marks, which means at least 72 marks from the written component out of a possible 120. Unsuccessful candidates are shown their final scores where they have not reached the required standard; the score is not disclosed where candidates have achieved 60% or more.
Can I retake the exam if I fail?
Yes. Unsuccessful candidates may retake the CPSA exam 7 days after the original exam date. Use that window to review the syllabus areas where you were weakest, since the score feedback you receive is limited. Book the retake through Pearson VUE in the normal way once the seven days have passed.
Are there any pre-requisites?
No. The CPSA has no pre-requisite. It sits below the main CRT and CCT qualifications and tests assessing operating systems and common network services at a basic level, plus web application security testing. A valid CPSA certification is, however, the pre-requisite if you later want to take the CRT.
How difficult is the CPSA, and what trips people up?
It is an entry-level exam but broad: nine topic areas, from legislation and scoping through Windows, Unix, networking equipment and databases to web testing. Candidates typically come unstuck by over-focusing on web attacks and neglecting soft skills, assessment management, cryptography basics and interpreting tool output. The questions test knowledge beyond terminology, so understand why a result means what it means.
How should I structure my study?
Start with the full CPSA syllabus and the Notes for Candidates, then work through the official sample questions to get used to the wording and structure. Cover every listed topic area rather than only the technical ones, and use the recommended reading and CREST training providers to fill gaps. Practise interpreting scan and enumeration output, not just running tools.
When and how do I get my results?
Results from the automated process are provided by Pearson VUE to the candidate at the end of the exam session, and are also sent electronically by CREST within 5 working days. Digitally signed certificates, where appropriate, are emailed to candidates. Keep any case ID you are given if an issue occurs during the exam.
How do I book, reschedule or request accommodations?
The exam is delivered at a Pearson VUE centre of your choice; register and schedule through the Pearson VUE website. Cancellations, postponements and reschedules go through your own Pearson VUE booking page and must be done at least 24 hours before your exam date. For special accommodations, contact CREST Support at least 2 weeks before the potential exam date with a formal medical report, and register with Pearson VUE without booking until the request is processed.