CSPT
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
CSPT is an acronym used by more than one credential programme, and in the profile this page follows it refers to a practical, hands-on penetration-testing certification. The exam is aimed at security practitioners who already work with offensive tooling and want a formal benchmark of their ability to run an engagement end to end: agreeing scope and rules of engagement, performing reconnaissance, validating vulnerabilities rather than trusting scanner output, exploiting networks and web applications, moving through identity and directory-service attack paths, escalating privileges on Windows and Linux, and writing findings that a client can actually act on. Because the exam is scenario-driven, preparation is less about memorising trivia and more about repetition under realistic constraints: build a lab with a Windows domain and a small Linux estate, practise pivoting through dual-homed hosts, rehearse web exploitation against deliberately vulnerable applications, and keep notes and screenshots as you go so that reporting becomes routine rather than a last-minute scramble. Candidates should also read the awarding body's own published objectives, since the domain names and weightings shown here are provisional working assumptions and are not an official blueprint. The current logistics - question count, duration, fee, passing score and retake policy - are published by the certification body on its own website; candidates should verify them there before booking. This page is independent study material and is not affiliated with or endorsed by any awarding body.
What you'll study
About CSPT preparation
How many questions are on the CSPT exam, and how long does it take?
Those figures are set by the awarding body and can change between exam versions, so they are deliberately not quoted here. Check the official certification page for your region before you book, and plan your practice sessions around finishing tasks comfortably faster than the published limit.
What score do I need to pass?
The passing score is published by the certification body and is not restated on this page. Many practical exams weight sections differently, so a strong result in one domain will not necessarily compensate for a weak one - aim for competence across every objective rather than excellence in a favourite area.
Is the exam multiple choice or hands-on?
The profile lists multiple choice as the format, but the skills being tested - pivoting, exploit validation, privilege escalation - are practical in nature. Expect questions built around realistic scenarios and tool output rather than definitions, and prepare by doing the work in a lab, not by memorising lists.
How hard is it, and how long should I study?
Most candidates who struggle do so because of gaps in methodology rather than missing tools: incomplete reconnaissance, unvalidated findings, or poor note-taking. If you already work in offensive security, focused preparation over a few weeks is usually enough. Without that background, budget considerably more time.
What should I study first?
Start with scoping and rules of engagement, then reconnaissance, because every later phase depends on accurate information and clear authorisation boundaries. Move to vulnerability validation and web exploitation next, then network pivoting, directory-service attack paths, privilege escalation, and finally reporting practice.
Can I retake the exam if I fail?
Retake rules, waiting periods and any associated costs are set by the certification body and vary over time. Consult the official policy before you sit the exam, and treat a failed attempt as diagnostic: identify which domains cost you marks rather than repeating the same preparation.
What are the most common reasons candidates fail?
Running tools without understanding what they prove, missing a foothold because reconnaissance stopped too early, breaking out of scope under pressure, and producing reports with unreproducible findings. Examiners reward evidence: commands used, timestamps, screenshots and clear remediation advice.
Does this page represent the certification body?
No. This is independent study material produced without access to an official source document. The domain names and weightings shown are provisional and unverified, and the CSPT acronym is used by more than one programme, so confirm the awarding body and its published objectives before relying on this page.