CREST CCT
CREST Certified Tester (CCT)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The CREST Certified Tester (CCT) is a professional certification offered by CREST, a not-for-profit body that accredits and certifies cyber security service providers and their people. The CCT sits in CREST's skills and certifications pathway alongside its other tester qualifications, and is aimed at hands-on penetration testers and security consultants who want independent, vendor-neutral evidence of their practical testing ability. The exam is intended to test judgement as well as tooling: scoping and rules of engagement, methodical vulnerability discovery and analysis, safe exploitation and evidence capture, and clear reporting to both technical and business audiences. CREST publishes certification information through its certification pages, pricing and booking page, and a Pearson VUE booking link, and it also runs a Training Provider Programme and Practice Labs for candidates who prefer structured preparation. Important caveat for anyone planning around this page: at the time of writing, the specific CCT certification page on the CREST website returned a 404 error, so we could not verify the current question count, exam duration, passing score, fee, delivery format, retake rules, validity period or the official domain weightings. The four study domains shown on this page are therefore a provisional structure pending confirmation. Before booking, confirm all logistics directly with CREST, then prepare by combining hands-on lab work with report-writing practice.
What you'll study
About CREST CCT preparation
Is this page affiliated with CREST?
No. This is independent study material. It is not produced, endorsed or reviewed by CREST, and it does not reproduce any official exam content. Always treat the CREST website and your booking confirmation as the authoritative source for exam rules, content and logistics.
How many questions are on the CCT exam and how long do I get?
We cannot state this reliably. The official CCT page returned a 404 error when we checked, so the question count and time limit are unverified. Check the current CREST certification pages and your Pearson VUE booking confirmation, which normally restate the format and duration before you pay.
What score do I need to pass?
Unverified. No passing score is published on the source material we could retrieve, so we have not guessed one. CREST exams are generally criterion-referenced rather than curved, but confirm the current pass mark and any section-level requirements directly with CREST before you sit the exam.
How much does the exam cost and how do I book it?
The fee is not confirmed here. CREST maintains a certifications pricing and booking page, and exam booking is handled through Pearson VUE via a link from the CREST site. Check both for the current price, any member discount, and available test centres or remote-proctored slots.
If I fail, can I retake it and how soon?
The retake policy is not verified in our source, so we cannot give a waiting period or a cap on attempts. Ask CREST or check the certification pages before booking, and budget for the possibility that a retake requires a new fee and a mandatory waiting interval.
How difficult is the CCT and what trips candidates up?
Expect it to reward depth over trivia. The most common failure modes in practical tester exams are weak scoping and authorisation checks, incomplete vulnerability analysis, exploitation that produces no reproducible evidence, and reports that bury risk in tool output instead of explaining business impact and remediation.
In what order should I study the four domains?
Start with methodology, because scoping, rules of engagement and coverage planning frame everything else. Then move to vulnerability identification and analysis, then exploitation technique, and finish with reporting and professional conduct, practising written findings throughout. Treat the domain weightings as provisional until CREST confirms the current syllabus.
Does CREST offer training or practice labs for this exam?
CREST lists a Training Provider Programme, a searchable training provider directory and Practice Labs on its site, plus a route to become a training provider. These are useful for structured preparation and hands-on time. Verify that any provider's course actually maps to the current CCT syllabus before you pay.
How long is the certification valid?
Unverified. No validity period is stated in the source we retrieved, so we have not assumed one. Confirm recertification or continuing professional development requirements with CREST when you book, and diarise any expiry date as soon as your result is confirmed.