CREST CCT study guide
CREST CCT · Work through your exam, one topic at a time.
The CREST Certified Tester (CCT) is a professional certification offered by CREST, a not-for-profit body that accredits and certifies cyber security service providers and their people. The CCT sits in CREST's skills and certifications pathway alongside its other tester qualifications, and is aimed at hands-on penetration testers and security consultants who want independent, vendor-neutral evidence of their practical testing ability. The CREST CCT study guide has 4 sections and about 1,615 words.
01Security testing and assessment methodology
This domain tests whether you can plan and govern an assessment rather than just run tools: how you agree scope, select a methodology, justify coverage, and keep the work lawful, reproducible and defensible if it is later challenged in a report or a courtroom. Authorisation precedes everything.
422 words, about 2 min02Vulnerability identification and analysis
This domain tests whether you can find weaknesses and then reason about them: verify what a scanner claims, classify the root cause, and place it in the client's business context rather than pasting raw tool output into a report. Every finding is verified manually.
401 words, about 2 min03Penetration testing execution and exploitation techniques
This domain tests your discipline under pressure: turning a validated vulnerability into demonstrated impact while staying inside scope, avoiding damage, and producing proof that survives scrutiny. Pre-exploitation checks: confirm the target resolves to an in-scope asset, confirm the change window, and know the stop condition and rollback plan before sending a payload.
379 words, about 2 min04Reporting, communication and professional conduct
This domain tests whether the engagement produces value and stays ethical: a report a non-technical executive can act on, findings a engineer can reproduce, and conduct that protects the client and the tester. Executive summary: business risk in plain language, the headline issues, and an overall verdict.
413 words, about 2 min