How many questions are on the Practitioner Intrusion Analyst exam?

The Practitioner Intrusion Analyst exam has 120 questions, and the vendor's published description is: The CPIA Examination is comprised of one hundred and twenty (120) multiple choice questions to be completed over a 2-hour period (permitted maximum session time at Pearson VUE is 2.5 hours in total).

How long do you have to complete the Practitioner Intrusion Analyst exam?

You get 120 minutes, which is about 60 seconds per question. The published format is: The CPIA Examination is comprised of one hundred and twenty (120) multiple choice questions to be completed over a 2-hour period (permitted maximum session time at Pearson VUE is 2.5 hours in total).

What score do you need to pass the Practitioner Intrusion Analyst exam?

The passing score is 60% (Successful candidates must score 60% of the available marks. That is: at least 72 marks from the written component (possible total: 120 marks).).

What are the domains on the Practitioner Intrusion Analyst exam?

There are 4 domains: Host Based Attacks, Network and Application Attacks, Network and Host Based Investigation, Overview of the Intrusion Analysis Process. The official weights are Host Based Attacks 25%, Network and Application Attacks 30%, Network and Host Based Investigation 25%, Overview of the Intrusion Analysis Process 20%.

How should I use the domain weights when revising?

Weight by percentage, not by domain. 25% is the one where lost points cost you the most, and Certilum scores you per domain so you can see exactly where that is.

Does Certilum have practice questions for the Practitioner Intrusion Analyst exam?

Yes: 120 questions in our bank for this certification, each tagged to the exam domain it belongs to, with the official domain weights applied.

Exam format

Practitioner Intrusion Analyst Exam Format

CPIA

Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The CREST Practitioner Intrusion Analyst (CPIA) certification is designed for individuals who are beginning their career in cybersecurity and want to validate their practical skills in network security monitoring, intrusion detection, and incident response. This certification focuses on the core technical skills required to analyze network traffic, host-based logs, and common attack vectors. It is the foundational credential from CREST within their technical assurance track. The exam tests hands-on ability in a controlled environment, requiring candidates to demonstrate competence in using security tools, interpreting data, and writing basic intrusion analysis reports. Unlike purely academic certifications, the CPIA strongly emphasizes practical application. Acquiring this certification signals to employers that you possess the necessary analytical mindset and technical foundation to assist in security operations center (SOC) workflows and contribute to intrusion analysis engagements.

120 questions

120 min

60% to pass

4 domains

certilum

Exam facts at a glance

The published specifications for this certification.

Specification	Value
Questions	120
Time limit	120 minutes (60s per question)
Passing score	60% — Successful candidates must score 60% of the available marks. That is: at least 72 marks from the written component (possible total: 120 marks).
Domains	4
Level	Associate
Question bank here	120 questions
Published format	The CPIA Examination is comprised of one hundred and twenty (120) multiple choice questions to be completed over a 2-hour period (permitted maximum session time at Pearson VUE is 2.5 hours in total)
Source	Official exam specification, published by the vendor

Official domain weights

The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.

Domain	Weight	Topics	Practice Qs
Host Based Attacks	25%	Analyze operating system logs (Windows, Linux) for signs of compromise Identify malware artifacts on host systems (e.g., persistence mechanisms, network connections) Analyze memory and disk forensics data at a foundation level +2 more	30
Network and Application Attacks	30%	Identify and analyze common network-based attacks (e.g., DoS, DDoS, MITM, DNS Spoofing) Analyze application layer attacks (e.g., Injection, XSS, CSRF) Analyze web server and database attacks +2 more	36
Network and Host Based Investigation	25%	Utilize intrusion detection and analysis tools (e.g., Snort, Suricata, Zeek) Perform log analysis and correlation across multiple sources Construct and analyze timelines of security incidents +2 more	30
Overview of the Intrusion Analysis Process	20%	Understand the incident response lifecycle (Preparation, Detection, Analysis, Containment, Eradication, Recovery) Apply the intrusion analysis methodology (pivot, correlate, validate) Write clear and concise written intrusion analysis reports +2 more	24

The heaviest domain is Host Based Attacks at 25%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.

Note from the vendor record: Issuer confirmed from CREST's own site: this is the CREST Practitioner Intrusion Analyst (CPIA), an entry-level Incident Response exam - it is issued by CREST (International), not by IACIS or another body. It is active and bookable at Pearson VUE test centres worldwide, has no prerequisite exam but is itself the prerequisite for the CREST Registered Intrusion Analyst (CRIA), and CREST's examination terms state all CREST qualifications are valid for three (3) years. Retake is allowed 7 days after a failed attempt; note the acronym CPIA can be confused with unrelated "privacy analyst" style credentials, but only CREST publishes an exam under this exact name. Official exam page