Registered Threat Intelligence Analyst

Exam format

CREST logo

Registered Threat Intelligence Analyst Exam Format

CRTIA

Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The CREST Registered Threat Intelligence Analyst (CRTIA) certification is a globally recognized credential designed for professionals who collect, analyze, and disseminate threat intelligence. This exam validates the candidate's ability to understand the threat landscape, apply the intelligence lifecycle, use various intelligence sources (OSINT, dark web, technical feeds), and produce actionable reports for different stakeholders. The syllabus covers core domains including intelligence principles, collection methods, analytical frameworks, reporting standards, and operational integration with incident response teams. CRTIA holders demonstrate practical competence in turning raw data into strategic, operational, and tactical intelligence that helps organizations proactively defend against cyber threats. The exam is practical and scenario-based, requiring candidates to demonstrate critical thinking and analytical rigor rather than mere memorization.

120 questions
180 min
70% to pass
5 domains

Exam facts at a glance

The published specifications for this certification.

SpecificationValue
Questions120
Time limit180 minutes (90s per question)
Passing score70% — The examination consists of a multiple choice paper. Candidates are required to meet or exceed a two-thirds pass mark in the multiple choice paper. Success will confer Registered status to the individual.
Domains5
LevelProfessional
Question bank here150 questions
Published format"The examination will consist of two components: a multiple-choice paper [and] a selection of long form questions that require detailed written answers." Official Notes for Candidates: multiple-choice component comprises 120 questions (1 mark each = 120 marks); long form is three questions worth 25 marks each of which candidates "should select and answer only two (2)" (= 50 marks); "There are 3 hours available in total for the exam." Written-only, closed book, no practical element.
SourceOfficial exam specification, published by the vendor

Official domain weights

The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.

DomainWeightTopicsPractice Qs
Analysis and Processing25%
  • Apply analytical techniques (e.g., structured analytic techniques, diamond model)
  • Correlate indicators of compromise (IOCs) with threat actor groups
  • Perform malware analysis basics and reverse engineering concepts
  • +2 more
37
Dissemination and Reporting20%
  • Write actionable intelligence reports for technical and non-technical audiences
  • Create threat briefings and executive summaries
  • Apply marking, handling, and classification procedures
  • +2 more
30
Intelligence Collection and Sources25%
  • Identify and evaluate open-source intelligence (OSINT) sources
  • Leverage human intelligence (HUMINT) and technical intelligence (TECHINT)
  • Utilize dark web monitoring and deep web data sources
  • +2 more
43
Threat Intelligence Concepts and Principles15%
  • Define threat intelligence and its strategic, operational, and tactical levels
  • Explain the intelligence cycle (direction, collection, processing, analysis, dissemination)
  • Understand the difference between data, information, and intelligence
  • +2 more
24
Operational Intelligence and Incident Response15%
  • Integrate threat intelligence into incident response and SOC operations
  • Support proactive threat hunting using intelligence-driven approaches
  • Monitor and track threat actor campaigns and infrastructure
  • +2 more
16

The heaviest domain is Analysis and Processing at 25%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.

Note from the vendor record: Active and delivered at Pearson VUE; the qualification is "valid for three (3) years" per the official Notes for Candidates. No formal prerequisite is published on the official CRTIA page or Notes for Candidates (only "A minimum of two years' experience collecting, analysing and documenting threat intelligence is expected") - a CPTIA prerequisite is Not published by the provider. Caveat: pass-mark conflict between official sources - the certification page says "two-thirds pass mark in the multiple choice paper", while the Notes for Candidates state "Successful candidates must score 70% of the available marks in each component" (at least 84/120 multiple choice and at least 35/50 long form). Fee is priced at Registered level (600 GBP). Official exam page

More about the Registered Threat Intelligence Analyst exam

Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.

Exam costPass rateWho can take itStudy plan

Related certifications

Explore other certifications in the same category and see how they stack up.

Certified Information Privacy Manager
Certified Information Privacy Manager
IAPPIAPP
Certified Information Privacy Professional/US
Certified Information Privacy Professional/US
IAPPIAPP
Certified Information Privacy Technologist
Certified Information Privacy Technologist
IAPPIAPP
Certified Threat Intelligence Manager
Certified Threat Intelligence Manager
CRESTCREST
CompTIA SecurityX
CompTIA SecurityX
CompTIACompTIA
ISACA CDPSE
ISACA CDPSE
ISACAISACA

Frequently asked questions

Everything you need to know about the Registered Threat Intelligence Analyst exam.