CREST CPSA study guide
CREST CPSA · Work through your exam, one topic at a time.
The CREST Practitioner Security Analyst (CPSA) is an entry-level certification that tests a candidate's knowledge of assessing operating systems and common network services, together with an intermediate level of web application security testing. It is aimed at people moving into hands-on penetration testing roles: CREST describes successful candidates as qualified for hands-on pen test roles, indicative of around two years of experience. The CREST CPSA study guide has 9 sections and about 2,330 words.
01Soft Skills and Assessment Management
Assessment work is as much about scoping, communication and reporting as it is about tooling. A candidate must understand the phases of an engagement: scoping and rules of engagement, reconnaissance, testing, reporting, and retest/closure.
300 words, about 2 min02Core Technical Skills
This domain tests foundational knowledge that underpins every later topic: TCP/IP, ports and protocols, the OSI model, encoding, and basic command-line fluency on Windows and Unix. You should be comfortable mapping common services to ports (e.g., 22 SSH, 25 SMTP, 53 DNS, 80/443 HTTP/S, 139/445 SMB, 1433 MSSQL, 3306 MySQL, 3389 RDP), and knowing whether a protocol is TCP, UDP, or both (DNS uses both; NTP is UDP/123).
259 words, about 1 min03Background Information Gathering and Open Source
OSINT is the disciplined collection of publicly available information about a target before touching it. Candidates must know the categories: organizational (domains, subsidiaries, staff, technologies), infrastructure (IP ranges, DNS records, certificates), and human (roles, emails, social presence).
251 words, about 1 min04Networking Equipment
This domain covers how network devices are configured, segmented, and secured, and how their misconfigurations become test targets. Understand the roles of routers (Layer 3 routing between networks), switches (Layer 2 forwarding, VLANs), firewalls (rule-based filtering, stateful inspection), and proxies/load balancers.
255 words, about 1 min05Microsoft Windows Security Assessment
Windows assessment focuses on identity, access, and configuration. Understand accounts and groups (local vs domain, built-in groups like Administrators, and privileged groups such as Domain Admins), authentication protocols (NTLM vs Kerberos), and where credentials are exposed.
254 words, about 1 min06Unix Security Assessment
Unix assessment centers on file permissions, accounts, services, and privilege. Understand the permission model: owner/group/other with read/write/execute, and the special bits - setuid (run as owner), setgid (run as group / inherit directory group), and sticky bit (restrict deletion in shared directories).
239 words, about 1 min07Web Testing Methodologies
Web testing methodology is about structure: how you approach an application so coverage is deliberate rather than random. Understand the components of a web app - client (browser), transport (TLS), server, application logic, and data store - and the trust boundaries between them.
246 words, about 1 min08Web Testing Techniques
Techniques are the concrete methods used to validate the weaknesses identified by methodology. For injection, understand how untrusted input reaching an interpreter (SQL, command, template) changes behaviour, and how to confirm it safely - error-based, boolean, and time-based signals.
266 words, about 1 min09Databases
Database knowledge supports both direct assessment and web injection testing. Understand the relational model: tables, rows, columns, primary keys (uniquely identify a row), foreign keys (referential integrity), and indexes (performance, not security).
260 words, about 1 min