Exam format
Certified Threat Intelligence Manager Exam Format
Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The CREST Certified Threat Intelligence Manager (CCTIM) certification is an advanced, vendor-neutral credential designed for cybersecurity professionals who lead or manage threat intelligence operations. It validates the ability to collect, analyze, and disseminate actionable intelligence across tactical, operational, and strategic levels. The exam emphasizes real-world application, requiring candidates to demonstrate expertise in threat actor profiling, intelligence governance, and supporting incident response through an intelligence-led lens. CCTIM is widely recognized as a gold standard for intelligence management, ensuring certified individuals can drive intelligence maturity within organizations, communicate effectively to senior leadership, and operate within legal and ethical boundaries.
- 120 questions
- 120 min
- 70% to pass
- 5 domains
certilumExam facts at a glance
The published specifications for this certification.
| Specification | Value |
|---|---|
| Questions | 120 |
| Time limit | 120 minutes (60s per question) |
| Passing score | 70% — Successful candidates must score 70% of the available marks in each component (at least 126 of 180 marks CCTIM1, 42 of 60 marks CCTIM2 long form, 84 of 120 marks scenario); 'This represents an overall pass mark of approximately 70%, but note that candidates must score the minimum number of marks in each section' |
| Domains | 5 |
| Level | Expert |
| Question bank here | 120 questions |
| Published format | Not published by the provider as a range; official format: three components - short-form questions, long-form questions and a written scenario element - delivered in two parts (TIM 1 and TIM 2, each 3 hours at Pearson VUE; TIM 1 comprises 150 short-form questions plus 1 long-form question, TIM 2 comprises 2 long-form questions plus 1 scenario question) |
| Source | Official exam specification, published by the vendor |
Official domain weights
The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.
| Domain | Weight | Topics | Practice Qs |
|---|---|---|---|
| Threat Actor Analysis and Profiling | 20% |
| 25 |
| Intelligence Analysis and Production | 25% |
| 30 |
| Intelligence Management and Governance | 25% |
| 31 |
| Strategic Intelligence and Future Trends | 10% |
| 10 |
| Operational Intelligence and Incident Response | 20% |
| 24 |
The heaviest domain is Threat Actor Analysis and Profiling at 20%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.
Note from the vendor record: Issuer confirmed as CREST (International); the credential is active and listed on CREST's certification, pricing and digital-badge pages. The two parts must be taken at Pearson VUE with part 2 within three months of part 1, the exam is closed book and written-only, and the CREST certification is valid for three years. CREST states the exam 'does not confer any status under the NCSC CHECK scheme and is not recognised for the purposes of equivalency with any other schemes'; no formal prerequisite is published, but breadth of threat-intelligence and operational experience is expected. Caveat: no single total question count is published and the fee is listed only at Certified level. Official exam page
More about the Certified Threat Intelligence Manager exam
Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.
Related certifications
Explore other certifications in the same category and see how they stack up.
Frequently asked questions
Everything you need to know about the Certified Threat Intelligence Manager exam.