BSCP

It is issued by PortSwigger, the makers of Burp Suite. The certification page describes the Burp Suite Certified Practitioner as an official certification for web security professionals, demonstrating deep knowledge of web security vulnerabilities, the exploitation mindset, and the Burp Suite skills needed to carry this out. This study page is independent and is not affiliated with PortSwigger.

The source states it is aimed at penetration testers and the organizations that employ them. Individual testers use it to prove proficiency to employers and the community, while teams use it to demonstrate testing proficiency to potential clients and to identify strong new talent. It is not positioned as an entry-level credential for people new to web security.

Two things, per the official page: complete the required preparation, which means working through the preparation steps and reading the hints and guidance, and have access to an active subscription of Burp Suite Professional. You should also check the technical and system requirements so your machine is at the right specification and you have all needed files and information.

Follow the official sequence: work through the published preparation steps, then read the hints and guidance before booking. Preparation is built around the Web Security Academy, so concentrate on understanding vulnerability classes and practising exploitation rather than memorising theory. The page also links a practice exam, which is worth using to test yourself under realistic conditions before purchasing credit.

The source page does not state a fee, an exam duration, a question count, or a passing score; it only says you purchase an exam credit when ready and after completing preparation. Because these details are not given in the retrieved source, check the official certification page directly for current figures rather than relying on secondhand numbers.

Five years. The official page states that once acquired, your certification will last for five years, and your digital certificate clearly states the validity, including both the start and end dates. After it expires you would need to validate again; the page refers readers to the terms and conditions for further detail.

Each candidate who successfully passes receives a link to their certificate with a unique certification identifier. That identifier can be included on your CV, shared with employers, and posted to social profiles. The digital certificate itself states the validity period with start and end dates, so employers can confirm it is current.

Yes. The certification page provides a way to verify your certification and view your certificate, and each certificate carries a unique certification identifier. Sharing that identifier or the certificate link lets an employer or client confirm the credential and check the stated start and end dates rather than taking a CV claim at face value.

Booking before finishing the required preparation. The official page is explicit that you should work through the preparation steps and read the hints and guidance first, and confirm your machine meets the technical and system requirements. Skipping that leaves you unfamiliar with the environment and the expected exploitation approach, which is a poor position for a practical exam.

No. The page frames the credential around demonstrating knowledge of vulnerabilities, the correct mindset to exploit them, and Burp Suite Professional skills, and it requires an active Burp Suite Professional subscription to take the exam. That points to hands-on, tool-based assessment rather than recall of definitions, so practise in Burp Suite Professional is essential.