Practitioner Threat Intelligence Analyst

Exam format

CREST logo

Practitioner Threat Intelligence Analyst Exam Format

CPTIA

Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The CREST Practitioner Threat Intelligence Analyst (CPTIA) certification validates an individual's foundational knowledge and practical skills in cyber threat intelligence. The exam covers the full intelligence lifecycle, from collection and analysis to dissemination and operationalization. Candidates are expected to understand core concepts, apply analytical methodologies, and produce actionable intelligence that supports organizational security decisions. This certification is vendor-neutral and focuses on real-world application rather than theoretical knowledge alone. It is an ideal entry-point certification for professionals looking to specialize in threat intelligence and demonstrate competence to employers globally.

120 questions
120 min
66% to pass
5 domains

Exam facts at a glance

The published specifications for this certification.

SpecificationValue
Questions120
Time limit120 minutes (60s per question)
Passing score66% — Candidates are required to meet or exceed a two-thirds pass mark in the multiple-choice paper to obtain CREST Practitioner status.
Domains5
LevelAssociate
Question bank here120 questions
Published formatThe written component of the CPTIA Examination will comprise one hundred and twenty (120) multiple choice questions, all of which the candidate must complete; there are 2 hours available in total for the exam (per Notes for Candidates)
SourceOfficial exam specification, published by the vendor

Official domain weights

The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.

DomainWeightTopicsPractice Qs
Threat Intelligence Collection20%
  • Identify and evaluate sources of threat intelligence (OSINT, commercial feeds, government sharing, internal logs)
  • Apply collection methods for technical indicators (IPs, domains, hashes, URLs)
  • Collect human intelligence (HUMINT) and social media intelligence (SOCMINT) ethically
  • +4 more
24
Operationalizing Threat Intelligence15%
  • Apply threat intelligence to proactive defense (hunting, hardening, deception)
  • Use intelligence to prioritize vulnerability management and patching
  • Support incident response with contextual intelligence
  • +4 more
18
Threat Intelligence Concepts and Principles20%
  • Define threat intelligence and its core components
  • Explain the intelligence lifecycle (Direction, Collection, Processing, Analysis, Dissemination, Feedback)
  • Differentiate between strategic, operational, tactical, and technical intelligence
  • +4 more
24
Threat Intelligence Analysis and Production30%
  • Apply analytical techniques (structured analysis, hypothesis testing, critical thinking)
  • Analyze malware, network traffic, and log data to extract threat indicators
  • Correlate disparate data points to identify patterns and campaigns
  • +5 more
36
Threat Intelligence Dissemination and Integration15%
  • Tailor intelligence reporting to different audiences (executives, technical teams, SOC)
  • Use standardized formats (STIX, TAXII, MISP taxonomies) for sharing
  • Integrate threat intelligence with security tools (SIEM, SOAR, firewalls, EDR)
  • +3 more
18

The heaviest domain is Threat Intelligence Collection at 20%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.

Note from the vendor record: Issuer confirmed from CREST's own site: CREST Practitioner Threat Intelligence Analyst (CPTIA), an entry-level threat-intelligence exam with no experience prerequisite, active and delivered at Pearson VUE test centres. Conflict in official sources on the pass mark: the current CREST webpage states a "two-thirds pass mark" while CREST's official Notes for Candidates (May 2022) states 70% (at least 84 of 120 marks) - both figures come from crest-approved.org. The qualification is valid for three (3) years per the Notes for Candidates; note the acronym is easily confused with the separate CREST Practitioner Intrusion Analyst (CPIA) exam. Official exam page

More about the Practitioner Threat Intelligence Analyst exam

Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.

Related certifications

Explore other certifications in the same category and see how they stack up.

Frequently asked questions

Everything you need to know about the Practitioner Threat Intelligence Analyst exam.