Exam Orientation and Honest Assessment
Understanding exactly what you are preparing for, how CREST fits into the industry, and where your 5 years of IAM/PAM experience gives you an advantage.
1A. What is CREST?
CREST (Council of Registered Ethical Security Testers) is an international, not-for-profit accreditation body that certifies both companies and individual professionals who perform penetration testing (authorized attempts to break into systems to find security weaknesses before real attackers do). Think of CREST as the "bar exam" for penetration testers: it validates that you have real, tested technical skills, not just theoretical knowledge.
CREST certifications are recognized across the UK, Australia, Singapore, Hong Kong, and increasingly across Europe, the Middle East, and Southeast Asia. In the UK specifically, holding CREST credentials is often a mandatory requirement for government security work under the NCSC CHECK scheme. Financial services firms, defense contractors, and consultancies frequently list CREST as a hiring requirement.
How CREST compares to other certifications
| Certification | Focus | Format | Recognition | Your Priority |
|---|---|---|---|---|
| CREST CPSA | Pentest foundations: networking, OS security, web basics | 120 MCQ, 2 hours, closed book | Strong in UK, AU, SG, growing globally | Your target exam |
| CompTIA Security+ | Broad security theory (governance, risk, compliance, architecture) | ~90 MCQ + PBQ, 90 minutes | Very strong globally, especially US | Significant overlap with CPSA; your IAM background covers much of this already |
| CEH (EC-Council) | Ethical hacking terminology and theory | 125 MCQ, 4 hours | HR-recognized; less respected by technical practitioners | Low priority; CPSA is more rigorous |
| OSCP (OffSec) | Hands-on penetration testing | 24-hour practical exam + report | Highly respected by technical teams globally | Future goal after CRT; OSCP holders can claim CRT equivalency if they also hold CPSA |
1B. What is the CPSA exam?
| Attribute | Details |
|---|---|
| Full name | CREST Practitioner Security Analyst (CPSA) |
| What it tests | Theory only (no practical/hands-on component). Tests your knowledge of operating systems, network services, web application security, cryptography, and penetration testing methodology. |
| Exam format | 120 multiple-choice questions (MCQ), each worth 1 mark. No points deducted for wrong answers. |
| Time limit | 2 hours for the exam itself. Pearson VUE allocates a 2.5-hour session window total (includes check-in time). |
| Pass mark | 60%, meaning at least 72 out of 120 correct answers. |
| Exam delivery | In-person at a Pearson VUE testing center. Closed book: no notes, no internet, no electronic devices. |
| Cost | Approximately £275 for non-members (~$350 USD). CREST members pay £192.50 (~$245 USD). Check for current pricing and promotions. |
| Prerequisites | None. Anyone can sit the CPSA. However, CPSA is a prerequisite for the CRT exam. |
| Validity | 3 years from the date of passing. You must retake the exam or progress to a higher CREST certification to remain certified. |
| Retake policy | Unsuccessful candidates may retake the exam after a minimum 7-day waiting period. |
| Score disclosure | If you fail, CREST shows your score. If you pass, the score is not disclosed (you only know you passed). |
1C. Honest Assessment of Your Readiness
Your 5 years of IAM/PAM experience gives you a meaningful head start in several CPSA domains. Here is where you stand:
Where your IAM/PAM background helps directly
- Windows Security Assessment (Appendix E): You already understand Active Directory, group policies, user provisioning, and privilege management. This domain will feel familiar.
- Soft Skills and Assessment Management (Appendix A): Scoping, compliance awareness, and understanding client requirements are core consulting skills you already have.
- Parts of Core Technical Skills (Appendix B): Authentication protocols (Kerberos, LDAP, SAML, OIDC), cryptography concepts (hashing, encryption), and access control models are your daily work.
Where you will need focused study
- Networking deep-dive: TCP/IP internals, packet analysis, specific port numbers for dozens of protocols, Nmap scan types and flags.
- Unix/Linux security: File permissions, NFS, Samba, privilege escalation paths, common service enumeration.
- Web application security: OWASP Top 10, SQL injection mechanics, XSS, CSRF, session hijacking, HTTP header analysis.
- Database security: SQL injection in Oracle, MySQL, MSSQL; default ports and credentials; stored procedures.
- Port and protocol memorization: A significant portion of exam questions test recall of port numbers, protocol abbreviations, and service defaults.
You have strong foundations in identity, access control, and Windows/AD, which cover roughly 25-30% of the syllabus. The remaining 70% covers offensive security concepts (network scanning, vulnerability enumeration, exploitation theory, web attacks) that are likely new to you. With focused study at 10 hours per week, plan for 16 to 20 weeks of preparation.
1D. Certification Pathway Recommendation
CPSA is the correct starting point for you. It is the entry-level exam in CREST's penetration testing track. The progression is: CPSA (theory) → CRT (practical, infrastructure + web) → CCT (advanced). You cannot attempt CRT without holding a valid CPSA. There is no need to take anything else first. Your 5 years of IAM/PAM experience exceeds the "indicative 2 years of experience" that CREST suggests for CPSA candidates.
Foundational Knowledge Checklist (Phase 0)
Given your 5 years of IT experience, you can skip or skim several of these foundations. The table below indicates your likely status for each area and where to invest time.
| # | Topic | Why Pentesters Need It | Your Status | Free Resource | Self-Test |
|---|---|---|---|---|---|
| 1 | How computers work (CPU, RAM, storage, OS) | Understanding how programs execute in memory is essential for recognizing buffer overflow vulnerabilities and how malware operates. | Skip | Khan Academy: Computers & Internet | Explain what happens in RAM when you open a program. |
| 2 | Networking fundamentals (IP, DNS, DHCP, subnets, routing) | Every pentest begins with network reconnaissance. You must understand how traffic flows between systems to identify what is exposed and exploitable. | Review | Professor Messer: Network+ Course (free videos) | Calculate the usable host range for 192.168.1.0/26. |
| 3 | OSI and TCP/IP models | The CPSA exam directly tests which protocol operates at which layer, and what happens at each layer when data traverses a network. | Study | TryHackMe: Intro to Networking (free) | Name all 7 OSI layers and give one protocol example for each. |
| 4 | Common protocols (HTTP/S, FTP, SSH, SMB, DNS, SMTP, RDP, SNMP) | Pentesters probe these services on every engagement. You must know default ports, common misconfigurations, and what information each service leaks. | Study | TryHackMe: Protocols and Servers (free) | List the default port for: FTP, SSH, SMTP, DNS, HTTP, POP3, IMAP, HTTPS, SMB, RDP, SNMP, LDAP, MySQL, MSSQL, PostgreSQL. |
| 5 | Linux command line | Most pentesting tools run on Linux (specifically Kali Linux). You must be comfortable navigating the filesystem, managing processes, and reading output. | Review | TryHackMe: Linux Fundamentals Part 1-3 (free) | Find all files owned by root with SUID bit set. Write the command. |
| 6 | Windows internals (AD, registry, services, PowerShell) | Windows environments are the primary target in enterprise pentesting. AD misconfigurations are among the most common attack vectors. | Strong | TryHackMe: Intro to Active Directory (free) | Explain the difference between a local admin account and a domain admin account, and why a pentester targets domain admin. |
| 7 | Basic scripting (variables, loops, reading code) | Pentesters read exploit code to understand what it does before running it. You do not need to be a programmer, but you must be able to read Python and Bash. | Review | Codecademy: Learn Python 3 (free tier) | Read a 20-line Python script and explain what it does, line by line. |
| 8 | Security fundamentals (CIA triad, authn vs authz, encryption) | The conceptual framework for everything in the CPSA. Without this, nothing else makes sense. | Strong | TryHackMe: Security Principles (free) | Give a concrete example of a confidentiality breach, an integrity breach, and an availability breach. |
| 9 | How the internet works (DNS resolution, TLS, certificates, proxies) | Web application testing requires deep understanding of how HTTPS connections are established, how certificates are validated, and where an attacker can intercept traffic. | Study | TryHackMe: DNS in Detail (free) | Trace the full path of a DNS query from your browser to receiving the IP address, including recursive resolvers, root servers, TLD servers, and authoritative servers. |
| 10 | Virtual machines and lab environments | All pentesting practice happens in isolated virtual environments. You must be able to create, configure, and network VMs. | Review | VirtualBox User Manual | Create a VM, attach it to a host-only network, and verify it can communicate with another VM on the same network. |
Given your background, focus on items marked CRITICAL and REVIEW. Estimated: 2 to 3 weeks at 10 hours per week. Skip items marked "Strong" unless the self-test question stumps you.
Full Syllabus Deconstruction
The CPSA syllabus is divided into 10 appendices (A through J). Each appendix is a domain. Below is a breakdown of every domain with exam weight, your advantage areas, and the topics that trip up candidates.
A large percentage of CPSA questions test port number recall, protocol abbreviations/acronyms, and service fingerprinting details. Memorization is unavoidable for this exam. Flashcards are essential.
Appendix A: Soft Skills and Assessment Management
| Sub-Topic | Weight | Plain English | You Must Be Able To |
|---|---|---|---|
| A1: Engagement Lifecycle | Important | How a penetration test is planned, scoped, executed, and reported. | Describe all phases of a pentest from scoping through report delivery. |
| A2: Law and Compliance | Critical | UK laws that govern computer access: Computer Misuse Act 1990, Police and Justice Act 2006, Data Protection Act 2018, Human Rights Act 1998. | Know which law applies to each scenario. Know what makes a pentest legal vs. illegal. |
| A3-A5: Scoping and Reporting | Important | Understanding what to test, managing denial-of-service risks during testing, writing findings for both technical and executive audiences. | Distinguish between black-box, grey-box, and white-box testing. |
Your IAM advantage: Compliance, scoping, and stakeholder management are familiar territory. Focus your study on the specific UK legislation.
Trick question pattern: Questions about which specific law applies to unauthorized access vs. data theft vs. DoS attacks.
Appendix B: Core Technical Skills
| Sub-Topic | Weight | Plain English | You Must Be Able To |
|---|---|---|---|
| B1: IP Protocols (IPv4, TCP, UDP, ICMP) | Critical | How data travels across networks. TCP uses a "three-way handshake" (SYN, SYN-ACK, ACK) to establish connections. UDP does not. | Identify TCP flags in packet captures. Explain the difference between TCP and UDP. Know ICMP types. |
| B4-B6: Network Mapping and OS Fingerprinting | Critical | Using tools like Nmap to discover what machines exist on a network, what ports are open, and what operating system they run. | Know Nmap scan types: -sS (SYN), -sT (TCP connect), -sU (UDP), -sV (version), -O (OS detect). Know which scan type is stealthier and why. |
| B8-B9: Cryptography | Critical | Encryption (making data unreadable without a key), hashing (creating a fixed-length fingerprint of data), and digital signatures. | Differentiate symmetric (AES, DES, 3DES) from asymmetric (RSA, Diffie-Hellman). Know hash types by length: MD5=32 hex, SHA-1=40 hex, SHA-256=64 hex. Know AES key sizes (128, 192, 256 bit) and round counts (10, 12, 14). |
| B13-B14: Network Sniffing | Important | Capturing and analyzing network traffic using tools like Wireshark and tcpdump. | Read a PCAP file and identify credentials, protocols, and anomalies. |
Your IAM advantage: Cryptography concepts (hashing, PKI, certificates) are familiar from your PAM/vault work.
Trick question pattern: Questions asking you to identify a hash type from its character length, or which cipher mode (ECB, CBC, CFB) has a specific weakness.
Appendix C: Background Information Gathering and Open Source
| Sub-Topic | Weight | Plain English | You Must Be Able To |
|---|---|---|---|
| C1: WHOIS and DNS | Critical | Querying public registries to learn who owns a domain, what IP addresses it resolves to, and what mail/name servers it uses. | Know DNS record types: A, AAAA, MX, NS, CNAME, PTR, TXT, SOA, SRV. Know the tools: dig, nslookup, host, whois. |
| C2: Google Hacking | Important | Using advanced search operators to find exposed files, login pages, and sensitive information indexed by search engines. | Know operators: site:, filetype:, intitle:, inurl:, cache:. |
| C3-C4: OSINT and Footprinting | Important | Gathering information about a target organization from publicly available sources before any active scanning. | Explain passive vs. active reconnaissance and give examples of each. |
Appendix D: Networking Equipment
| Sub-Topic | Weight | Plain English | You Must Be Able To |
|---|---|---|---|
| D1: Network Architectures and Protocols | Critical | How VLANs, switches, routers, and firewalls segment and protect networks. | Explain VLAN hopping, ARP spoofing, and how a switch differs from a hub. |
| D2: Firewall and IDS/IPS | Important | Devices that filter traffic (firewalls), detect attacks (IDS), or automatically block attacks (IPS). | Distinguish stateful vs. stateless firewalls. Explain signature-based vs. anomaly-based detection. |
| D4-D6: VPN, IPSec, Wireless (802.11) | Important | Secure tunneling protocols and wireless security standards. | Know the difference between WEP (broken), WPA (TKIP), WPA2 (CCMP/AES), WPA3. Know IPSec modes: transport vs. tunnel, AH vs. ESP. |
Appendix E: Microsoft Windows Security Assessment
| Sub-Topic | Weight | Plain English | You Must Be Able To |
|---|---|---|---|
| E1-E2: User Enumeration, Password Attacks | Critical | Discovering valid usernames on Windows systems and attempting to crack or guess their passwords. | Know tools: net user, net group, enum4linux. Know SAM database location. Know NTLM vs. NTLMv2 hash formats. |
| E3-E5: Registry, Patch Levels, Services | Important | The Windows registry stores configuration settings. Unpatched systems and misconfigured services are common attack vectors. | Identify critical registry hives. Know common Windows service ports (135, 139, 445, 3389). |
| E9: Exchange Server, AD | Important | Microsoft's email server and directory service are high-value targets in every enterprise. | Know common AD attack vectors: Kerberoasting, Pass-the-Hash, Golden Ticket (at a conceptual level for CPSA). |
Your IAM advantage: This is your strongest domain. AD, privileged accounts, and Windows authentication are your daily work.
Appendix F: Unix Security Assessment
| Sub-Topic | Weight | Plain English | You Must Be Able To |
|---|---|---|---|
| F1-F3: User Enumeration, Passwords, File Permissions | Critical | Linux stores passwords in /etc/shadow (hashed). File permissions (rwx) determine who can read, write, or execute files. | Read a Unix permission string (e.g., -rwsr-xr-x). Know SUID/SGID and why they are dangerous. Know /etc/passwd vs /etc/shadow. |
| F4-F9: NFS, Samba, R-services, Sendmail | Important | Network file sharing (NFS), Windows-compatible file sharing (Samba), and legacy remote access services. | Know NFS root squashing. Know EXPN/VRFY commands in SMTP. Know default ports for these services. |
Appendices G-H: Web Testing Methodologies and Techniques
| Sub-Topic | Weight | Plain English | You Must Be Able To |
|---|---|---|---|
| G1-G2: OWASP Methodology | Critical | OWASP (Open Web Application Security Project) provides a standardized methodology for testing web applications and a "Top 10" list of the most common web vulnerabilities. | Name all OWASP Top 10 categories. Explain the testing methodology. |
| H1-H6: SQL Injection, XSS, CSRF, Session Attacks | Critical | SQL Injection: tricking a database into executing attacker commands by inserting SQL code into input fields. XSS (Cross-Site Scripting): injecting malicious JavaScript into web pages viewed by other users. CSRF (Cross-Site Request Forgery): forcing a logged-in user's browser to send requests they did not intend. | Write a basic SQL injection payload. Explain the difference between stored XSS and reflected XSS. Know how CSRF tokens prevent attacks. |
| H8-H13: Authentication, Session Management, Fuzzing | Important | Testing how web applications handle login, session cookies, and unexpected input. | Know session fixation vs. session hijacking. Know what fuzzing means (sending random/malformed data to find crashes). |
Trick question pattern: Distinguishing between first-order and second-order SQL injection, or between DOM-based and reflected XSS.
Appendix I-J: Databases
| Sub-Topic | Weight | Plain English | You Must Be Able To |
|---|---|---|---|
| I1-I3: MSSQL, Oracle, MySQL | Important | Enterprise databases are high-value targets containing sensitive business data. | Know default ports: MSSQL=1433, Oracle=1521, MySQL=3306, PostgreSQL=5432. Know common default accounts. Know what xp_cmdshell does in MSSQL. |
| J1-J3: Database Fundamentals | Supplementary | Understanding SQL syntax and how databases store and retrieve data. | Write a basic SELECT statement. Understand UNION-based SQL injection concept. |
Phased Study Plan with Timeline
Based on 10 hours per week, targeting exam readiness before December 2026. Total estimated preparation: 16 to 20 weeks (4 to 5 months).
Foundation Reinforcement
Focus: Fill gaps in networking, Linux CLI, and protocol knowledge. You already have Windows/AD and security fundamentals.
- Week 1: OSI/TCP-IP models, IP addressing, subnetting (Professor Messer videos + TryHackMe Intro to Networking room)
- Week 2: Common protocols and port numbers. Create your first flashcard set. Complete TryHackMe "Protocols and Servers" room.
- Week 3: Linux fundamentals (TryHackMe Linux Fundamentals Parts 1-3). DNS deep-dive (TryHackMe "DNS in Detail").
Phase 0 Checkpoint Quiz (3 questions)
1. What are the TCP flags in a standard three-way handshake, in order?
2. What is the default port for SNMP, and which transport protocol does it use?
3. On a Linux system, what does the command find / -perm -4000 -type f 2>/dev/null search for, and why is this important for a pentester?
Theory and Protocol Deep Dive
Focus: Systematic study of all 10 CPSA syllabus domains. This is the heaviest reading phase.
- Week 4: Appendix A (Soft Skills, UK Law) + Appendix B (Core Technical: IP protocols, TCP flags, ICMP types)
- Week 5: Appendix B continued (Cryptography: symmetric/asymmetric, hash identification, cipher modes, PKI) + Appendix C (OSINT, WHOIS, DNS records)
- Week 6: Appendix D (Networking equipment, VLANs, firewalls, wireless security) + Appendix E (Windows security, AD, registry)
- Week 7: Appendix F (Unix security, file permissions, NFS, Samba) + Appendices I-J (Database security, default ports, SQL basics)
- Week 8: Appendices G-H (Web testing methodologies, OWASP Top 10, SQL injection, XSS, CSRF, session management)
Primary resource: "Network Security Assessment" by Chris McNab (3rd edition), cross-referenced with the CPSA syllabus PDF.
Phase 1 Checkpoint Quiz (3 questions)
1. A hash value is 40 hexadecimal characters long. What algorithm most likely produced it?
2. Under the UK Computer Misuse Act 1990, what are the three primary offences?
3. An Nmap scan shows port 1433 open. What service is likely running, and what is one common attack against it?
Tool Familiarity and Guided Labs
Focus: Hands-on practice with the tools and techniques referenced in the exam. Even though CPSA is theory-only, understanding what tools produce helps you answer questions about their output.
- Week 9: Nmap deep-dive (all scan types, scripting engine basics). Complete TryHackMe "Nmap" room. Practice reading Nmap output.
- Week 10: Web application basics. PortSwigger Web Security Academy: SQL Injection labs (Apprentice level), XSS labs (Apprentice level).
- Week 11: Windows enumeration practice (enum4linux, net commands). TryHackMe "Active Directory Basics" room.
- Week 12: Linux enumeration. Practice with LinPEAS output reading. SMTP enumeration (VRFY/EXPN). NFS enumeration.
Phase 2 Checkpoint Quiz (3 questions)
1. What is the difference between nmap -sS and nmap -sT? Which is stealthier and why?
2. You see this in an HTTP response: Set-Cookie: session=abc123; HttpOnly; Secure. What do the HttpOnly and Secure flags prevent?
3. What does the NFS option "no_root_squash" allow, and why is it a security risk?
Mock Exams and Weak-Spot Drilling
Focus: Timed practice exams. Identify and eliminate weak areas. Intensive flashcard drilling on ports and acronyms.
- Week 13: Take first Udemy CPSA practice exam (untimed). Review every wrong answer. Create targeted flashcards for missed topics.
- Week 14: Take second practice exam (timed: 2 hours). Focus on time management. Drill port numbers and acronyms daily (15 min/day).
- Week 15: Take third practice exam. Deep-dive into your two weakest domains. Re-read relevant chapters of Network Security Assessment.
- Week 16: Take fourth practice exam. Target score: 80%+. Review CREST official sample questions. Begin scheduling your exam.
Phase 3 Checkpoint Quiz (3 questions)
1. What port does LDAPS use, and how does it differ from LDAP with STARTTLS?
2. Explain the difference between stored XSS and reflected XSS. Which is generally considered more dangerous and why?
3. In AES encryption, how many rounds are performed for a 256-bit key?
Final Review and Exam Readiness
Focus: Light review only. Avoid cramming new material. Reinforce weakest areas. Rest before exam day.
- Week 17: Final mock exam. Review CREST sample questions one more time. Light flashcard review (ports, acronyms, hash lengths). Re-read UK legislation notes.
- Week 18: Day before exam: light review only (30 min max). Get proper sleep. Prepare ID documents. Confirm Pearson VUE appointment.
Lab Environment Setup Guide
Specific instructions for macOS Sonoma. Although CPSA is a theory exam, hands-on practice with tools dramatically improves your understanding of what exam questions are testing.
5A. Hypervisor Installation (UTM for macOS)
On modern Macs (especially Apple Silicon M1/M2/M3/M4), VirtualBox has limited support. The recommended hypervisor is UTM, which is free and runs natively on Apple Silicon.
Install UTM on macOS Sonoma
Verification: Open UTM from Applications. You should see an empty VM gallery. If the app opens without errors, installation is successful.
If it fails: Ensure macOS Sonoma is updated to the latest version. Check System Settings > Privacy & Security for any blocked app warnings.
5B. Kali Linux Setup
Download and configure Kali Linux VM
For Apple Silicon Macs (M1/M2/M3/M4):
For Intel Macs: Download the AMD64 ISO instead. You may also use VirtualBox (download from virtualbox.org).
Verification:
5C. Practice Platform Accounts
With a $30/month budget, here is the optimal allocation:
| Platform | URL | Cost | What to Do | Syllabus Domains |
|---|---|---|---|---|
| TryHackMe | tryhackme.com | $14/month | Pre-Security path, Jr Penetration Tester path. Specific rooms: Nmap, Protocols and Servers, DNS in Detail, OWASP Top 10, Linux Fundamentals 1-3, Intro to Active Directory, Network Security | B, C, D, E, F, G, H |
| PortSwigger Web Security Academy | portswigger.net/web-security | Free | SQL Injection (all Apprentice labs), XSS (all Apprentice labs), CSRF (all Apprentice labs), Authentication vulnerabilities (Apprentice) | G, H, I |
| Udemy CPSA Practice Exams | Udemy CPSA Practice Tests | ~$15 one-time (wait for sale) | 600+ practice questions across 4 mock exams. Complete all 4 exams during Phase 3. | All domains (A-J) |
| CREST Official Sample Questions | CREST CPSA page | Free | Complete all available sample questions. These show the exact style and difficulty of real exam questions. | All domains |
| Quizlet CPSA Flashcards | quizlet.com/subject/cpsa | Free | Daily 15-minute flashcard sessions on ports, acronyms, and hash types. Start in Phase 1, continue through exam day. | B, D, E, F, I |
| CPSA Prep (free practice) | crest-cpsa.vercel.app | Free | 2,500+ free practice questions with configurable quiz length and timer. Use for supplementary drilling. | All domains |
TryHackMe: $14/month for 3-4 months = $42-56. Udemy practice exams: ~$15 on sale. PortSwigger, CREST samples, Quizlet, CPSA Prep: all free. Total: ~$57-71 for entire preparation. Well within your $30/month budget.
5E. Lab Verification Checklist
Tool Mastery Guide
For CPSA, you need to understand what these tools do and interpret their output. You do not need to be an expert operator, but you must recognize scan results, flags, and output formats when described in exam questions.
| Tool | What It Does | Domain | Must-Know Commands/Flags | Exam Gotcha |
|---|---|---|---|---|
| Nmap | Network scanner: discovers hosts, open ports, running services, and operating systems on a network. | B, D | -sS (SYN/stealth scan), -sT (TCP connect), -sU (UDP scan), -sV (version detection), -O (OS detection), -sn (ping sweep, no port scan), -p- (scan all 65535 ports), -A (aggressive: OS + version + scripts + traceroute) |
-sS requires root/sudo because it creates raw packets. -sT does not. Exam may ask which scan works without root privileges. |
| Wireshark / tcpdump | Packet capture and analysis tools. Wireshark has a GUI; tcpdump is command-line only. | B | Wireshark filters: tcp.port == 80, http.request.method == "POST". tcpdump: tcpdump -i eth0 -w capture.pcap, tcpdump -r capture.pcap |
Know the difference between capture filters (applied during capture) and display filters (applied after capture) in Wireshark. |
| Burp Suite | Web application proxy: intercepts, inspects, and modifies HTTP/HTTPS requests between your browser and a web server. | G, H | Proxy tab (intercept requests), Repeater (modify and resend), Intruder (automated fuzzing), Decoder (encode/decode Base64, URL encoding, etc.) | The free Community Edition does not include the Scanner. Exam questions about automated web vulnerability scanning may reference Burp Scanner (Pro feature) or alternative tools like Nikto/OWASP ZAP. |
| dig / nslookup / host | DNS query tools: look up IP addresses, mail servers, name servers, and other DNS records for a domain. | C | dig example.com ANY (all records), dig example.com MX (mail servers), dig @8.8.8.8 example.com (query specific DNS server), dig -x 1.2.3.4 (reverse DNS) |
Know which record type returns which data: A=IPv4, AAAA=IPv6, MX=mail, NS=nameserver, CNAME=alias, PTR=reverse, TXT=arbitrary text (often SPF/DKIM), SOA=zone authority. |
| enum4linux | Extracts information from Windows/Samba systems: user lists, share names, group memberships, password policies. | E | enum4linux -a <target_ip> (full enumeration), enum4linux -U <target_ip> (users only) |
enum4linux relies on SMB null sessions. Many modern Windows systems block null sessions by default, so the tool may return empty results. Exam may test your understanding of why. |
| Nikto | Web server scanner: checks for dangerous files, outdated software versions, and common misconfigurations on web servers. | G | nikto -h http://target |
Nikto is extremely noisy (generates thousands of requests) and will be detected by any IDS/IPS. Not suitable for stealth assessments. |
| whois | Queries domain registration databases to find who owns a domain, when it was registered, and what name servers it uses. | C | whois example.com |
GDPR has caused many European registrars to redact personal information from WHOIS results. Exam may reference this. |
| sqlmap | Automated SQL injection detection and exploitation tool. | H, I | sqlmap -u "http://target/page?id=1" --dbs (enumerate databases) |
For CPSA, understand what SQL injection is and how sqlmap automates it. You do not need to memorize sqlmap flags, but know it exists and what it does. |
Knowledge Benchmark Test
10 questions at CPSA difficulty. Take this test before you start studying to establish your baseline, then again after Phase 2 to measure progress. Answers are in collapsible blocks below each question.
8-10 correct: Skip to Phase 3 (mock exams). 5-7 correct: Start at Phase 1 (theory deep-dive). 3-4 correct: Start at Phase 0 (foundations). 0-2 correct: Start at Phase 0 and extend timeline.
During a network scan, you observe that the target system responds to a SYN packet with a RST/ACK packet. What does this indicate about the port?
A) The port is open and accepting connections
B) The port is closed
C) The port is filtered by a firewall
D) The service is running but requires authentication
View Answer
Correct: B) The port is closed.
When a port is closed, the OS sends back a RST/ACK (reset) packet, telling the sender "nothing is listening here." An open port would respond with SYN/ACK (the second step of the three-way handshake). A filtered port would either drop the packet silently (no response) or send an ICMP unreachable message. Option D is not how TCP works at the port-scanning level.
If wrong, revisit: TCP three-way handshake, Nmap scan types, TCP flag meanings.
You encounter the following hash: 5d41402abc4b2a76b9719d911017c592. Based on its length, what hashing algorithm most likely produced it?
A) SHA-1
B) SHA-256
C) MD5
D) bcrypt
View Answer
Correct: C) MD5.
MD5 produces a 128-bit hash, displayed as 32 hexadecimal characters. SHA-1 produces 40 hex characters. SHA-256 produces 64 hex characters. bcrypt outputs start with "$2a$" or "$2b$" and are much longer. Count the characters: this hash has exactly 32, confirming MD5.
If wrong, revisit: Hash identification by length (MD5=32, SHA-1=40, SHA-256=64, SHA-512=128).
Under the UK Computer Misuse Act 1990, which of the following is an offence?
A) Accessing a publicly available website without authorization
B) Unauthorized access to computer material
C) Running a port scan against your own home network
D) Using a VPN to access the internet
View Answer
Correct: B) Unauthorized access to computer material.
The CMA 1990 defines three primary offences: (1) unauthorized access to computer material, (2) unauthorized access with intent to commit further offences, and (3) unauthorized modification of computer material. Accessing a public website is authorized by its nature. Scanning your own network is authorized because you own it. Using a VPN is not an offence.
If wrong, revisit: UK Computer Misuse Act 1990, Police and Justice Act 2006 amendments.
What type of web vulnerability allows an attacker to inject malicious SQL statements into an application's database query through user input?
A) Cross-Site Scripting (XSS)
B) Cross-Site Request Forgery (CSRF)
C) SQL Injection
D) Directory Traversal
View Answer
Correct: C) SQL Injection.
SQL Injection occurs when user input is passed directly into a database query without proper sanitization. XSS involves injecting JavaScript into web pages. CSRF tricks a user's browser into making unintended requests. Directory Traversal involves navigating outside the intended directory structure using sequences like ../../.
If wrong, revisit: OWASP Top 10, SQL Injection fundamentals.
Scenario: You are performing reconnaissance on a target organization. You need to identify their mail servers. Which DNS record type should you query?
A) A record
B) CNAME record
C) MX record
D) PTR record
View Answer
Correct: C) MX record.
MX (Mail Exchange) records specify the mail servers responsible for receiving email for a domain. A records map domain names to IPv4 addresses. CNAME records create aliases (one domain name pointing to another). PTR records perform reverse DNS lookups (IP address to domain name).
If wrong, revisit: DNS record types and their purposes.
Scenario: You discover that a wireless network is using WEP encryption. What should you advise the client?
A) WEP is secure if a strong password is used
B) WEP has known vulnerabilities and can be cracked in minutes regardless of password strength
C) WEP is deprecated but still acceptable for non-sensitive networks
D) WEP should be upgraded to WPA (TKIP)
View Answer
Correct: B) WEP has known vulnerabilities and can be cracked in minutes.
WEP (Wired Equivalent Privacy) has fundamental cryptographic flaws in its RC4 implementation that allow complete key recovery within minutes, regardless of password complexity. Option A is wrong because the vulnerability is in the protocol, not the password. Option C is wrong because WEP is never acceptable. Option D is partially right (upgrade is needed) but WPA with TKIP has its own weaknesses; the recommendation should be WPA2 (AES/CCMP) or WPA3 at minimum.
If wrong, revisit: Wireless security standards (WEP, WPA, WPA2, WPA3).
Practical scenario: On a Linux system, you find a file with permissions -rwsr-xr-x. The file is owned by root. What is the security significance of the "s" in the owner execute position?
View Answer
Answer: The "s" indicates the SUID (Set User ID) bit is set. When any user executes this file, it runs with the privileges of the file owner (root in this case), regardless of who is running it. This is a significant security concern because if the program has a vulnerability (such as a buffer overflow or command injection), an attacker can exploit it to execute arbitrary commands as root, achieving privilege escalation (moving from a low-privilege account to full system control).
If wrong, revisit: Linux file permissions, SUID/SGID bits, privilege escalation techniques.
Which Windows file stores local user password hashes?
A) /etc/shadow
B) NTDS.dit
C) SAM (Security Account Manager)
D) LSASS.exe
View Answer
Correct: C) SAM (Security Account Manager).
/etc/shadow is a Linux file, not Windows. NTDS.dit stores domain-wide password hashes on domain controllers (not local accounts). LSASS.exe is a running process that handles authentication and may have credentials in memory, but it is not a file that stores hashes persistently. The SAM database stores local user account password hashes and is located at C:\Windows\System32\config\SAM.
If wrong, revisit: Windows authentication architecture, SAM vs NTDS.dit, LSASS.
Practical: An Nmap scan reveals port 1521 is open on a target server. What database service is most likely running?
A) MySQL
B) Microsoft SQL Server
C) Oracle Database
D) PostgreSQL
View Answer
Correct: C) Oracle Database.
Default database ports: MySQL=3306, MSSQL=1433, Oracle=1521, PostgreSQL=5432. Memorize these; they are commonly tested on the CPSA.
If wrong, revisit: Default service ports for common databases.
In AES (Advanced Encryption Standard), which of the following is true?
A) AES supports key sizes of 64, 128, and 256 bits
B) AES is an asymmetric encryption algorithm
C) AES uses 10 rounds for a 128-bit key, 12 for 192-bit, and 14 for 256-bit
D) AES uses the RC4 stream cipher internally
View Answer
Correct: C) AES uses 10/12/14 rounds for 128/192/256-bit keys respectively.
AES is a symmetric block cipher (not asymmetric, ruling out B). It supports 128, 192, and 256-bit keys (not 64-bit, ruling out A). AES is based on the Rijndael cipher and uses substitution-permutation network operations, not RC4 (ruling out D). The round counts (10, 12, 14) are a commonly tested detail.
If wrong, revisit: AES specification, symmetric vs asymmetric encryption, block vs stream ciphers.
Exam Day Guide
8A. Registration and Logistics
- Visit the CREST CPSA page and click "Book Now" to be directed to Pearson VUE.
- Create a Pearson VUE account (or log in if you have one from other certifications).
- Search for "CREST" and select "CREST Practitioner Security Analyst (CPSA)."
- Choose a testing center near you and select your preferred date and time.
- Pay the exam fee (approximately £275 / $350 for non-CREST-members).
- Check the CREST promotions page before booking: periodic discounts of up to 30% are offered.
8B. What to Bring and What to Expect
- Bring two forms of ID: One must be a government-issued photo ID (passport or driver's license). The second can be a credit/debit card with your name on it. The name must match your Pearson VUE registration exactly.
- Arrive 30 minutes early. You will need to check in, store personal belongings in a locker, and be escorted to your workstation.
- Closed book: No notes, books, phones, smart watches, or electronic devices of any kind are permitted.
- Scratch paper: The testing center provides a laminated notepad or whiteboard and a marker. Use this for jotting down port numbers or working through complex questions.
- The interface: Standard Pearson VUE multiple-choice format. You can flag questions to review later. A timer is visible on screen.
8C. Time Management Strategy
120 questions in 120 minutes = exactly 1 minute per question.
- First pass (70 minutes): Answer every question you are confident about. Flag anything you are unsure of and move on. Do not spend more than 90 seconds on any single question.
- Second pass (35 minutes): Return to flagged questions. Use elimination to narrow choices. If unsure, make your best guess (there is no penalty for wrong answers).
- Final review (15 minutes): Review any remaining flags. Check that all 120 questions have an answer selected. Do not second-guess yourself unless you find a clear error.
8D. Technical Survival Tips
As soon as the exam starts, before reading the first question, brain-dump your memorized port numbers and acronyms onto the scratch paper. This frees up mental capacity for the actual questions.
On questions where you are unsure, eliminate obviously wrong answers first. Even eliminating one option improves your odds from 25% to 33%. Two eliminations give you 50/50.
CREST questions often ask for the "most appropriate" or "best" answer. Multiple choices may be technically correct, but one will be more correct in context. Read carefully.
Raise your hand immediately and alert the invigilator. Do not attempt to fix it yourself. A case will be filed and your exam time may be extended. Keep your case ID number.
8E. After the Exam
- Results timing: Results are typically available within a few business days. Some candidates report receiving results within 24-48 hours.
- If you pass: You will receive confirmation from CREST. Your score will not be disclosed. You can use the CREST Practitioner logo on your LinkedIn and resume. Your certification is valid for 3 years.
- If you fail: Your score will be shown. You can retake the exam after a minimum 7-day waiting period. Review your weak areas (you will know your score but not which specific questions you got wrong), revisit Phase 3, and take additional mock exams before retaking.
- Next step after passing: You are now eligible to sit the CRT exam, or to apply for CRT equivalency if you hold OSCP.
Supplementary Resources and Community
9A. Official Resources
- CPSA Official Page: crest-approved.org/...cpsa/
- CPSA Syllabus PDF (v2.5): CREST-CPSA-Technical-Syllabus-V2.5.pdf
- CREST Sample Questions: Available on the official CPSA page (scroll to "Sample Questions" section)
- CREST Certification Pricing: crest-approved.org/.../pricing/
9B. Books
| Book | Author | Domains Covered | How to Use |
|---|---|---|---|
| Network Security Assessment (3rd Ed.) | Chris McNab (O'Reilly) | B, C, D, E, F, I | Primary reference. Read chapters aligned to each syllabus appendix. Skip assembly language chapters (not tested on CPSA). |
| The Web Application Hacker's Handbook (2nd Ed.) | Dafydd Stuttard, Marcus Pinto | G, H | Reference for web testing domains. Focus on chapters covering SQL injection, XSS, session management, and authentication. |
| RTFM: Red Team Field Manual | Ben Clark | B, E, F | Quick reference only. Useful for command syntax review but not for learning concepts. |
| CREST Study Guide 2025-2026 | Robert J. Gray | All (A-J) | Supplementary. Includes 1,000+ practice questions. Use alongside official syllabus. |
9C. Video Courses
| Course | Platform | Cost | Domains | Notes |
|---|---|---|---|---|
| Professor Messer: CompTIA Network+ and Security+ | YouTube / professormesser.com | Free | A, B, D | Excellent for networking and security fundamentals. Significant overlap with CPSA content. Watch at 1.5x speed if material is familiar. |
| TryHackMe: Pre-Security and Jr Penetration Tester Paths | TryHackMe | $14/month | B, C, D, E, F, G, H | Interactive, guided labs. Best for hands-on understanding of the concepts tested in the exam. |
| HackTheBox Academy: CREST CPSA/CRT Preparation Path | HackTheBox | Subscription (~$18/month) | All (A-J) | Officially partnered with CREST. Maps directly to syllabus IDs. Higher quality and depth than TryHackMe but more expensive. Consider if budget allows after completing TryHackMe paths. |
| PortSwigger Web Security Academy | portswigger.net | Free | G, H, I | The gold standard for web application security training. Complete all Apprentice-level labs for SQL injection, XSS, and CSRF. |
9D. Community and Mentorship
- Reddit: r/netsecstudents and r/cybersecurity have active threads from CPSA candidates sharing tips and asking questions.
- TryHackMe Discord: Active community with study channels. Useful for getting unstuck on rooms.
- HackTheBox Discord: Community channels dedicated to CREST preparation.
- LinkedIn: Search for "CREST CPSA" to find study guides, experience reports, and connect with recent passers.
9E. After the CPSA: Career Path
Passing the CPSA opens the following progression:
- Immediate: You are now eligible to sit the CREST CRT (Registered Penetration Tester), which is a practical, hands-on exam.
- OSCP Route: If you pursue and pass OffSec's OSCP certification, you can apply for CRT equivalency (requires valid CPSA + OSCP passed within 3 years).
- Long-term: CRT → CCT-INF (Certified Tester, Infrastructure) or CCT-APP (Certified Tester, Application). CCT-level certifications qualify you for CHECK Team Leader status in the UK.
- Your unique advantage: Combining CREST pentesting credentials with your existing IAM/PAM expertise positions you uniquely for identity-focused penetration testing: Active Directory assessments, PAM bypass testing, and cloud IAM security reviews are in extremely high demand.
Very few security professionals have deep expertise in both building identity infrastructure and breaking it. After earning CPSA (and eventually CRT), you will be positioned to offer a rare and highly valued combination: understanding how enterprise IAM/PAM systems are designed, configured, and defended, while also knowing how attackers exploit their weaknesses. This is the exact profile that financial services firms, consulting agencies, and security vendors compete to hire.