Certified Tester - Application

Exam format

CREST logo

Certified Tester - Application Exam Format

CCT APP

Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The CREST Certified Tester - Application (CCT APP) certification validates advanced skills in application security testing, including web application penetration testing, vulnerability identification, and exploitation. It is designed for experienced penetration testers who can demonstrate hands-on ability to identify and exploit application-level vulnerabilities under realistic conditions. The certification is divided into written and practical examination components, testing both theoretical knowledge and real-world application security skills. Achieving CCT APP demonstrates a tester has met rigorous industry standards set by CREST, a globally recognized not-for-profit accreditation body. The certification covers the OWASP Top 10, advanced exploitation techniques, and professional reporting standards. Candidates must understand secure coding principles and have the ability to comprehensively test web applications, APIs, and mobile app backends. The practical exam typically lasts three hours and requires candidates to identify multiple vulnerabilities across a complex target application. The certification must be renewed every three years through continuing professional development activities. CREST certifications are particularly valued in the UK, Europe, Australia, and Asia-Pacific regions for both government and commercial sector engagements.

150 questions
66% to pass
5 domains

Exam facts at a glance

The published specifications for this certification.

SpecificationValue
Questions150
Time limitNot published by the vendor
Passing score66% — Written exam: "Candidates must achieve at least two thirds or 66% in each component (multiple choice test and written scenario) to achieve a pass." Practical exam: "Candidates must achieve at least two thirds or 66% in the practical exam to achieve a pass."
Domains5
LevelExpert
Question bank here150 questions
Published formatTwo parts: written exam 3 hours total (multiple-choice test 1 hour + written scenario 2 hours, plus 20 minutes reading time before the scenario) and a practical exam of 3 hours (plus 15 minutes reading time). Number of questions not published; written exam marking: multiple choice 60 marks, written scenario 120 marks.
SourceOfficial exam specification, published by the vendor

Official domain weights

The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.

DomainWeightTopicsPractice Qs
Reporting and Communication15%
  • Technical vulnerability report writing
  • Risk assessment and severity classification (CVSS)
  • Communicating findings to technical and non-technical stakeholders
  • +2 more
22
Professional Practice and Ethics15%
  • CREST code of conduct and professional ethics
  • Scope management and client engagement rules
  • Data protection and confidentiality requirements
  • +2 more
14
Application Security Fundamentals15%
  • Secure software development lifecycle principles
  • Common application vulnerabilities (OWASP Top 10)
  • Web application architectures and technologies
  • +2 more
23
Web Application Attacks and Exploitation30%
  • injection detection, exploitation, and mitigation
  • Cross-site scripting (XSS) variants and advanced payloads
  • Cross-site request forgery (CSRF) and server-side request forgery (SSRF)
  • +2 more
48
Application Security Testing Tools and Techniques25%
  • Automated vulnerability scanning tools and their limitations
  • Manual penetration testing methodologies
  • Proxy tools and traffic interception (e.g., Burp Suite, ZAP)
  • +2 more
43

The heaviest domain is Reporting and Communication at 15%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.

Note from the vendor record: Issuer: CREST (crest-approved.org, UK cyber-security certification body) - confirmed issuer of both "Certified Tester - Application (CCT APP)" and "Certified Tester - Infrastructure (CCT INF)", which are the paired disciplines of the CREST Certified Tester (CCT) programme; ISTQB and iSQI do not offer these exact titles. Status: active; current syllabus document is v3 dated 24 January 2024, and the official page notes updated content (macOS, social engineering, expanded cloud) and that the written scenario no longer contains a practical element. No prerequisites (official: "There are no pre-requisites to the CCT APP exam"). Delivery: written exam at 1,000+ Pearson VUE test centres, practical exam booked separately via Pearson VUE; results for the written scenario within 20 days, practical results ~24-48 hours. Renewal/validity period is Not published by the provider on the official exam page; CREST offers a 30% promotional discount code for candidates at member companies. Official exam page

More about the Certified Tester - Application exam

Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.

Exam costPass rateWho can take itStudy plan

Related certifications

Explore other certifications in the same category and see how they stack up.

Certified Ethical Hacker v13
Certified Ethical Hacker v13
EC-CouncilEC-Council
Certified Red Team Manager
Certified Red Team Manager
CRESTCREST
Certified Red Team Specialist
Certified Red Team Specialist
CRESTCREST
Certified Tester - Infrastructure
Certified Tester - Infrastructure
CRESTCREST
CompTIA PenTest+
CompTIA PenTest+
CompTIACompTIA
Offensive Security Certified Professional
Offensive Security Certified Professional
OffSecOffSec

Frequently asked questions

Everything you need to know about the Certified Tester - Application exam.