What score do you need to pass the Registered Intrusion Analyst exam?

The passing score is 60% (Achieved when an overall pass of 60% or 54 marks is secured).

What are the domains on the Registered Intrusion Analyst exam?

There are 5 domains: Malware Analysis, Incident Response, Network Security Monitoring, SOC Processes and Operations, Forensic Analysis and Investigation. The official weights are Malware Analysis 20%, Incident Response 25%, Network Security Monitoring 15%, SOC Processes and Operations 15%, Forensic Analysis and Investigation 25%.

How should I use the domain weights when revising?

Weight by percentage, not by domain. 20% is the one where lost points cost you the most, and Certilum scores you per domain so you can see exactly where that is.

Does Certilum have practice questions for the Registered Intrusion Analyst exam?

Yes: 150 questions in our bank for this certification, each tagged to the exam domain it belongs to, with the official domain weights applied.

Exam format

Registered Intrusion Analyst Exam Format

CRIA

Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The CREST Registered Intrusion Analyst (CRIA) certification is a globally recognized entry-level credential designed for professionals working in Security Operations Centers (SOCs). It validates the practical skills needed to detect, analyze, and respond to cyber threats effectively. The exam covers five core domains: Incident Response, Forensic Analysis and Investigation, Malware Analysis, Network Security Monitoring, and SOC Processes and Operations. Candidates are tested on their ability to perform hands-on analysis of real-world scenarios, including examining digital evidence, analyzing malware behavior, and correlating network events. A CRIA-certified professional demonstrates competency in triaging alerts, conducting forensic investigations, and contributing to incident response efforts. This certification is often a prerequisite for more advanced CREST qualifications and is highly valued by employers seeking skilled intrusion analysts. The exam emphasizes practical, scenario-based questions that require candidates to apply their knowledge under time constraints, ensuring they are job-ready upon certification. CRIA holders are equipped to handle initial incident response tasks, perform basic malware analysis, and support senior analysts in complex investigations. The certification also promotes adherence to industry best practices and legal frameworks, making it essential for compliance-driven environments.

150 questions

180 min

60% to pass

5 domains

certilum

Exam facts at a glance

The published specifications for this certification.

Specification	Value
Questions	150
Time limit	180 minutes (72s per question)
Passing score	60% — Achieved when an overall pass of 60% or 54 marks is secured
Domains	5
Level	Professional
Question bank here	150 questions
Published format	Official exam structure: "This CREST Registered-level practical based exam comprises one multiple-choice assessment, with answers weighted according to difficulty." Bullets: "An invigilated, multiple-choice assessment"; "Comprised of 150 questions, which all need to be attempted"; "Available to book at a Pearson Vue Testing Centre". Exam duration: "The exam duration is 2.5 hours."
Source	Official exam specification, published by the vendor

Official domain weights

The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.

Domain	Weight	Topics	Practice Qs
Malware Analysis	20%	Perform static analysis of malware samples (file properties, strings, hashes). Conduct dynamic analysis of malware in a sandboxed environment. Identify malware characteristics such as persistence mechanisms, C2 communications, and payloads. +2 more	31
Incident Response	25%	Understand and apply incident response methodologies (e.g., SANS PICERL, NIST SP 800-61). Identify, triage, and prioritize security incidents based on severity and impact. Conduct initial containment, eradication, and recovery procedures. +2 more	38
Network Security Monitoring	15%	Analyze network traffic logs from firewalls, IDS/IPS, and proxies. Interpret alerts from Security Information and Event Management (SIEM) systems. Identify anomalous network patterns and potential threats (e.g., port scans, data exfiltration). +2 more	22
SOC Processes and Operations	15%	Understand SOC tiers and escalation procedures. Apply knowledge of the Cyber Kill Chain and MITRE ATT&CK framework. Perform threat hunting based on hypotheses and IoCs. +2 more	21
Forensic Analysis and Investigation	25%	Acquire and preserve digital evidence from various sources (disk, memory, network). Perform forensic analysis of Windows and Linux systems to identify Indicators of Compromise (IoCs). Analyze volatile and non-volatile data using appropriate tools (e.g., Velociraptor, FTK Imager, Autopsy). +2 more	38

The heaviest domain is Malware Analysis at 20%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.

Note from the vendor record: Active; delivered entirely at Pearson VUE test centres. Prerequisite confirmed on the official page: candidates "are required to hold the 'CREST Practitioner' status by having successfully undertaken and passed the CREST Practitioner Intrusion Analyst exam" (CPIA), and "must hold a valid CREST Practitioner Intrusion Analyst certification to be able to book"; credential is "Valid for three (3) years". Caveat: pass-mark conflict between official sources - the certification page says "60% or 54 marks" while the CREST Assessors Panel Notes for Candidates PDF states CRIA needs "at least 90 marks (possible total: 150 marks)" (60% of 150). Legacy URL https://www.crest-approved.org/certification/cria/ returns 404 (verified); fee is set per level (600 GBP Registered), not per credential. Official exam page

More about the Registered Intrusion Analyst exam

Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.

Exam costPrice, retakes and total budget Pass rateThe score you need Who can take itRequirements and prerequisites Study planHow to prepare, by domain

Related certifications

Explore other certifications in the same category and see how they stack up.

Certified Incident Manager

CREST

Computer Hacking Forensic Investigator

EC-Council

Practitioner Intrusion Analyst

CREST

Frequently asked questions

Everything you need to know about the Registered Intrusion Analyst exam.

The Registered Intrusion Analyst exam has 150 questions, and the vendor's published description is: Official exam structure: "This CREST Registered-level practical based exam comprises one multiple-choice assessment, with answers weighted according to difficulty." Bullets: "An invigilated, multiple-choice assessment"; "Comprised of 150 questions, which all need to be attempted"; "Available to book at a Pearson Vue Testing Centre". Exam duration: "The exam duration is 2.5 hours.".

You get 180 minutes, which is about 72 seconds per question. The published format is: Official exam structure: "This CREST Registered-level practical based exam comprises one multiple-choice assessment, with answers weighted according to difficulty." Bullets: "An invigilated, multiple-choice assessment"; "Comprised of 150 questions, which all need to be attempted"; "Available to book at a Pearson Vue Testing Centre". Exam duration: "The exam duration is 2.5 hours.".