Exam format
Practitioner Security Analyst Exam Format
Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The CREST Practitioner Security Analyst (CPSA) certification is the foundational tier of CREST's penetration testing pathway, specifically designed for practitioners performing hands-on security assessments. It validates a candidate's breadth of knowledge across networking, security standards, penetration testing methodologies, tools, and professional ethics. The exam tests both theoretical understanding and practical reasoning through scenario-based multiple-choice questions (MCQs). Successful candidates demonstrate the ability to plan, execute, and report on a structured penetration test within defined scopes and legal frameworks. This certification is mandatory for those seeking higher-level CREST registrations (e.g., CRT, CCT) and serves as a benchmark for employers globally in regulated and commercial environments.
- 120 questions
- 120 min
- 60% to pass
- 5 domains
certilumExam facts at a glance
The published specifications for this certification.
| Specification | Value |
|---|---|
| Questions | 120 |
| Time limit | 120 minutes (60s per question) |
| Passing score | 60% — Successful candidates must score 60% of the available marks. That is: at least 72 marks from the written component (possible total: 120 marks). |
| Domains | 5 |
| Level | Associate |
| Question bank here | 120 questions |
| Published format | The written component of the CPSA Examination will comprise one hundred and twenty (120) multiple choice questions ... Your examination will last 2 hours (maximum session time at Pearson VUE is 2.5 hours in total) |
| Source | Official exam specification, published by the vendor |
Official domain weights
The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.
| Domain | Weight | Topics | Practice Qs |
|---|---|---|---|
| Tools and Technical Skills | 20% |
| 24 |
| Networking and Technologies | 30% |
| 36 |
| Professional Conduct and Ethics | 10% |
| 12 |
| Penetration Testing Methodologies | 20% |
| 24 |
| Information Security and Standards | 20% |
| 24 |
The heaviest domain is Tools and Technical Skills at 20%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.
Note from the vendor record: Issuer confirmed on crest-approved.org: CREST Practitioner Security Analyst (CPSA), CREST's entry-level penetration testing exam, active and booked through Pearson VUE; the older "CREST Practitioner Security Analyst" name is unchanged (no rename found). It has no prerequisite but is required before the CREST Registered Penetration Tester (CRT) exam, it is closed book, and CREST's examination terms state all CREST qualifications are valid for three (3) years (7-day retake after failure). Batch-4's assumed Practitioner price of ~GBP 400 is not what CREST publishes; the official Practitioner-level price is 275 GBP. Official exam page
More about the Practitioner Security Analyst exam
Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.
Related certifications
Explore other certifications in the same category and see how they stack up.
Frequently asked questions
Everything you need to know about the Practitioner Security Analyst exam.