What is the Practitioner Security Analyst exam format?

The Practitioner Security Analyst certification exam by CREST lasts approximately 120 minutes, with a passing score of 60%.

How many practice questions are available for the Practitioner Security Analyst exam?

The Practitioner Security Analyst practice question bank includes 360 questions across 3 levels (approximately 120 per level), each of which is available in three wording variants. That gives you up to 1080 practice question variations to study. On every attempt, questions appear in random order and answer options are shuffled, so each session evaluates your knowledge from a fresh angle.

What level is the Practitioner Security Analyst certification?

Practitioner Security Analyst is a ASSOCIATE level certification offered by CREST. Preparation is considered very complex and typically requires intermediate experience.

How should I prepare for the Practitioner Security Analyst exam?

Practitioner Security Analyst is organized into 5 exam domains, starting with Networking and Technologies, Information Security and Standards, Penetration Testing Methodologies. Practice with the Certilum diagnostic engine to simulate the CREST exam, pinpoint weak domains and measure your readiness before test day.

How difficult is the Practitioner Security Analyst exam?

The Practitioner Security Analyst exam has a difficulty score of 6.6/10 (Challenging). Preparation complexity is very complex. It typically requires intermediate experience. With a passing score of 60%, thorough preparation is recommended. Certilum's diagnostic engine helps you identify weak domains before test day.

Practitioner Security Analyst

CPSA

Validate your practical penetration testing and security analysis skills with the CREST Practitioner Security Analyst (CPSA) certification. This globally recognized credential is for professionals actively performing technical security assessments.

certilum

Exam syllabus, organized by domain

Try a real question

Sample Practitioner Security Analyst exam question

Answer this question the same way you would on exam day. No sign-up needed — one random question, three tries to swap it out.

ProficientTools and Technical Skills

What is the correct Burp Intruder attack type when you need to test all possible pairs from two independent payload sets?

burp-intruder

Attack type: Cluster bomb
Payload set 1: [user1, user2]
Payload set 2: [pass1, pass2]
Generates: user1+pass1, user1+pass2, user2+pass1, user2+pass2

Browse all certifications

Practice the Practitioner Security Analyst

Free Practitioner Security Analyst practice questions, scored per domain against the official blueprint.

Practitioner Security Analyst practice examFree diagnostic, scored per domain against the official blueprint.Practitioner Security Analyst exam questionsBrowse every Practitioner Security Analyst question in the bank, with explanations.How hard is the Practitioner Security Analyst exam?Our 1-10 difficulty score for this exam, broken down by domain.

Everything about the Practitioner Security Analyst exam

The questions people ask before booking, answered with the official specification.

Practitioner Security Analyst exam formatQuestion count, time limit and the official weight of each domain.Practitioner Security Analyst pass rateThe score you need, and whether the vendor publishes a cut score at all.Who can take the Practitioner Security AnalystPrerequisites, target audience and the skills being assessed.How to pass the Practitioner Security AnalystA revision plan ordered by domain weight, not by topic count.Practitioner Security Analyst exam costThe published fee, what it covers and the real total budget.

Frequently asked questions

Key facts about the Practitioner Security Analyst certification and how to prepare for it.

Skills & Requirements

What you need to know before attempting the Practitioner Security Analyst exam.

At least 12 months of professional or academic experience in IT security or network administration.
Thorough understanding of TCP/IP networking, including subnetting and routing protocols.
Familiarity with at least one scripting language (Python or Bash) used in automation of attacks.
Hands-on experience running and interpreting results from Burp Suite, Nmap, and Metasploit.
Completion of an accredited penetration testing course (e.g., CREST-approved training) recommended but not mandatory.

ChallengingScore: 6.6/10

High - The exam blends diverse technical domains (networking, cryptography, tools, legal) with practical penetration testing reasoning. Candidates must recall specific command syntax, tool outputs, scenario interpretations, and ethical decision-making simultaneously under tight time constraints per question. The theoretical breadth combined with real-world scenario application creates significant cognitive pressure requiring organized study and rapid recall.

Adopt a three-phase study approach. Phase 1 (Foundation - 4 weeks) covers Domain 1 & 2 using official CREST syllabus mapping, OWASP guides, and networking textbooks. Build mental models for each protocol/attack vector. Phase 2 (Skill Building - 4 weeks) focuses on Domain 3 & 4 with intensive hands-on labs (TryHackMe, HackTheBox, CREST virtual labs). Practice each tool (Burp, Nmap, Metasploit) daily until output interpretation becomes reflexive. Phase 3 (Exam Simulation - 2 weeks) solves CREST sample questions and mock exams under timed conditions. Review all wrong answers by domain. Ethical scenarios (Domain 5) require reading CREST ethics documentation and case studies. Final week is review of weak areas from mocks. Prioritize Domain 1 & 3 for time allocation (50% combined weight). Use spaced repetition flashcards for command syntax and vulnerability definitions.