Certified Red Team Specialist

Exam format

CREST logo

Certified Red Team Specialist Exam Format

CCRTS

Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The CREST Certified Red Team Specialist (CCRTS) certification is an advanced hands-on qualification designed for experienced penetration testers and security professionals aiming to specialize in red teaming. It validates the candidate's ability to plan, execute, and report on full-scope adversarial simulations that mimic real-world threat actors. The exam emphasizes deep technical proficiency in exploitation, lateral movement, and evasion techniques, as well as the strategic and communication skills necessary to lead complex engagements. Candidates must demonstrate mastery across multiple domains, from initial reconnaissance and intelligence gathering to advanced post-exploitation and C2 infrastructure management. The certification is globally recognized, particularly in regulated industries, and serves as a benchmark for senior red team roles. Successful candidates prove they can operate under realistic constraints, adapt to dynamic defenses, and deliver high-quality intelligence to improve organizational security posture.

60 questions
66% to pass
5 domains

Exam facts at a glance

The published specifications for this certification.

SpecificationValue
Questions60
Time limitNot published by the vendor
Passing score66% — Written exam: multiple choice 'at least two thirds or 40 marks', written scenario 'at least two thirds or 80 marks'; practical exam: Red Team Assault Course 'at least two thirds or 120 marks', Red Team Tactics/Tradecraft and Operational Security 'at least half of the marks available in this section or 60 marks' - 'Passing one of the sections but failing the other one will result in a failure overall'
Domains5
LevelExpert
Question bank here60 questions
Published formatNot published by the provider as a total question count; official format: written exam of 3 hours (multiple-choice test 1 hour, worth 60 marks, plus written scenario 2 hours, worth 120 marks) and a separate practical exam of 3 hours (assault course worth 180 marks plus operational security/tradecraft worth 120 marks), each with 15 minutes reading time
SourceOfficial exam specification, published by the vendor

Official domain weights

The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.

DomainWeightTopicsPractice Qs
Reporting and Communication15%
  • Produce clear, actionable, and executive-level reports
  • Articulate technical findings to both technical and non-technical audiences
  • Document attack paths, evidence, and remediation recommendations
  • +2 more
9
Adversary Emulation and TTPs20%
  • Map and emulate Tactics, Techniques, and Procedures (TTPs) from known threat actors
  • Utilize frameworks such as MITRE ATT&CK for structured emulation
  • Integrate command and control (C2) infrastructure effectively
  • +2 more
12
Exploitation and Post-Exploitation30%
  • Identify, prioritize, and exploit vulnerabilities in operating systems, networks, and applications
  • Execute privilege escalation techniques in Windows and Linux environments
  • Perform lateral movement and pivot across segmented networks
  • +2 more
18
Planning, Scoping, and Legal Compliance15%
  • Understand and apply legal and regulatory frameworks for red team engagements
  • Develop rules of engagement and scope documents
  • Identify and manage risks associated with adversarial simulations
  • +2 more
9
Reconnaissance and Intelligence Gathering20%
  • Conduct passive and active reconnaissance using OSINT tools
  • Perform network and application discovery and enumeration
  • Identify and analyze attack surface from an external and internal perspective
  • +2 more
12

The heaviest domain is Reporting and Communication at 15%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.

Note from the vendor record: Issuer confirmed as CREST (International); the credential is active and was formerly titled CREST Certified Simulated Attack Specialist (CCSAS). CREST states 'There are no pre-requisites to the CCRTS exam'; the written component is taken at Pearson VUE and the practical component in the CREST exam environment (files pre-uploaded via CRESTDrive), with MC results available immediately and other results within 20 days / 24-48 hours respectively. The credential is described as a critical requirement of the Bank of England CBEST scheme and the qualification is valid for three years. Caveat: fee is published at Certified level, not per exam, and exam parts must be booked separately. Official exam page

More about the Certified Red Team Specialist exam

Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.

Related certifications

Explore other certifications in the same category and see how they stack up.

Frequently asked questions

Everything you need to know about the Certified Red Team Specialist exam.