thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

CREST · Cybersecurity · Associate

CREST Practitioner Security Analyst (CPSA) exam guide

Exam CPSA

CREST Practitioner Security Analyst (CPSA) is the entry-level CREST exam for penetration testers, covering operating systems, network services and basic web application testing. In the UK and other CREST markets it is a common requirement for junior testers and a prerequisite for CREST Registered Tester (CRT).

Questions120
Time limit120 minutes
Passing score60% (72 of 120)
Exam feeSee official page
Valid forSee official page
DeliveryPearson VUE test center

Format: Multiple choice, closed book. Fee note: See CREST certifications pricing; CREST also issues vouchers to companies and individuals.

Who it's for

Junior penetration testers, especially those working for or applying to CREST member companies.

What the exam covers

Soft Skills and Assessment Management—
Core Technical Skills—
Background Information Gathering and Open Source—
Networking Equipment—
Microsoft Windows Security Assessment—
Unix Security Assessment—
Web Testing Methodologies—
Web Testing Techniques—
Databases—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: None.

Recommended: CREST indicates readiness for hands-on pen test roles, at roughly two years of experience.

Keeping it active

CREST certifications must be renewed periodically; check the current validity period and re-examination rules with CREST.

Skills & careers

Skills it validates

  • Network and service enumeration
  • Windows and Unix security assessment
  • Web application testing techniques
  • Database security basics
  • OSINT and information gathering
  • Engagement scoping and legal considerations

Job roles

Junior Penetration TesterSecurity AnalystVulnerability AssessorSecurity ConsultantIT Security Tester

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1-2: Download the CPSA syllabus and map each item to notes; cover networking and core technical skills.
  2. Week 3: Windows and Unix assessment topics.
  3. Week 4: Web testing methodologies, techniques and databases.
  4. Week 5: Practice questions on ports, protocols and tool output, then book at Pearson VUE.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • There is no negative marking, so answer every question.
  • Many questions test default ports, protocol behaviour and tool flags; memorise them.
  • Retakes are allowed 7 days after a fail.
  • Request any special accommodations from CREST at least two weeks before booking.

Key terms for this exam

All 4 terms Study with thinQcards™

Frequently asked questions

What is the CPSA pass mark?

60%, at least 72 of 120 questions.

Is CPSA required for CRT?

Yes, a valid CPSA is a prerequisite for CREST Registered Tester.

Is CPSA hard?

It is broad but multiple choice; practical testers usually pass with 4-6 weeks of review.

Where do I take it?

At Pearson VUE test centres worldwide.

CPSA vs OSCP+?

CPSA is a knowledge exam valued by CREST members; OSCP+ is a practical exam with wider global recognition.

Official page: www.crest-approved.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.