CREST CPSA study plan
CREST CPSA · Give each week a clear focus.
8 weeks · About 7 hours per week
Soft Skills and Assessment Management & Core Technical Skills
Draft a one-page assessment scoping template covering objectives, rules of engagement, and constraints
Write out the phases of a structured penetration test and match each CREST domain to its phase
Explain in writing how to handle scope creep and out-of-scope discoveries during an engagement
List the evidence-handling and reporting requirements you must satisfy before closing an assessment
Your checkpoint
A completed scoping and reporting checklist you could hand to a client, self-graded against the domain-1 objectives
Core Technical Skills
Compare TCP and UDP behaviour and identify which services use each
Trace the three-way handshake and explain how a half-open scan differs from a full connect scan
Map common ports and protocols to their default services
Describe how DNS resolution, HTTP requests, and TLS handshakes work at packet level
Your checkpoint
A one-page protocol quick-reference sheet plus 20 self-written recall questions answered without notes
Background Information Gathering and Open Source
Build a passive reconnaissance workflow using only public sources
Enumerate DNS records, subdomains, and certificate transparency data for a lab domain
Document how to search for leaked credentials and exposed metadata responsibly
Apply legal and ethical boundaries to each reconnaissance technique you list
Your checkpoint
A reconnaissance report on a deliberately vulnerable practice target showing sources used and findings
Networking Equipment
Identify default configurations and management interfaces on common routers, switches, and firewalls
Explain VLANs, ACLs, and how misconfigured rules create exposure
Describe how to assess SNMP, spanning tree, and network device authentication
List the risks of unpatched firmware and weak device credentials
Your checkpoint
A network device hardening review checklist with at least 15 concrete checks
Microsoft Windows Security Assessment
Enumerate Windows users, groups, services, and scheduled tasks from a lab host
Explain how to review patch levels and local security policy settings
Describe the risks of weak service permissions and unquoted paths
Outline how to assess SMB, RDP, and WinRM exposure safely
Your checkpoint
A Windows host assessment worksheet completed against a lab VM with findings and severity ratings
Unix Security Assessment
Audit file permissions and SUID/SGID binaries on a lab Linux host
Review cron jobs, init services, and shell profiles for privilege risks
Explain how to check for weak sudo rules and world-writable paths
Describe how to assess SSH configuration and account hygiene
Your checkpoint
A Unix host assessment worksheet completed against a lab VM with findings and remediation notes
Web Testing Methodologies & Web Testing Techniques
Build a web testing methodology that covers authentication, session handling, and input validation
Explain how to test for injection, XSS, and access control flaws at a conceptual level
Describe how to assess file upload, SSRF, and business logic weaknesses
Write up how to record evidence and rate findings for a web assessment
Your checkpoint
A full web testing methodology document plus a sample findings write-up for three hypothetical vulnerabilities
Databases
Explain how to test for SQL injection and describe safe exploitation boundaries
Describe how to review database permissions, accounts, and default configurations
Outline how to assess NoSQL and stored-procedure exposure
Consolidate weak areas across all nine domains into a revision list
Your checkpoint
A timed 60-question mixed-domain practice test scored and reviewed, with a written revision plan for any domain below 70%
Milestones
Week 2: Score at least 80% on the self-written core technical recall questions without notes
Week 4: Produce a reconnaissance report and network device checklist that a peer reviewer judges complete against the domain objectives
Week 6: Complete both the Windows and Unix host worksheets with at least ten findings each and defensible severity ratings
Week 8: Score 70% or higher on the mixed-domain practice test and have a written revision plan for every weak domain