You’ve spent months mastering tools and tinkering with home labs, but your resume still isn't getting the attention it deserves. In a crowded job market, the difference between a "thank you for applying" email and a high-six-figure job offer often comes down to one thing: a gold-standard credential.
The CREST Practitioner Security Analyst (CPSA) certification is the gold standard. It’s not just a badge; it’s a rigorous validation of your entry-level penetration testing skills. Whether you are a system administrator looking to pivot or a junior pentester aiming for a promotion, the CREST CPSA certification is your gateway to global recognition.
This guide provides a comprehensive roadmap to mastering the exam, understanding the costs, and navigating the technical requirements to ensure you pass on your first attempt.
Overview of CREST CPSA Certification
The CREST Practitioner Security Analyst (CPSA) is a professional qualification that tests a candidate’s knowledge in assessing operating systems and common network services. Unlike some entry-level certs that focus purely on theory, the CPSA is designed to be the foundational building block for the more advanced CREST Registered Penetration Tester (CRT) designation.
Exam Summary
-
Exam Code: CPSA
-
Duration: 120 Minutes
-
Format: 120 Multiple Choice Questions
-
Passing Score: 60%
-
Cost: $400 USD
-
Validity: 3 Years
The exam is delivered via Pearson VUE centers globally. It is important to note that the CPSA is a prerequisite for the CRT exam. If you pass the CPSA, you are halfway to becoming a fully CREST-registered tester.
The CREST CPSA is an entry-level but high-stakes exam that focuses on the technical breadth required for modern security assessments.
CREST CPSA Exam Cost and Value Analysis
Is the $400 Investment Worth It?
One of the most common questions is: Should I take the CREST CPSA if it costs $400? The short answer is yes. The CREST CPSA exam cost is a strategic investment in your professional "brand."
In regions like the UK, Australia, and parts of SE Asia, CREST is the mandatory benchmark for government and financial sector security work. Without it, many high-paying consultancy roles are simply out of reach.
CREST CPSA Salary Impact
Earning your CPSA doesn't just add letters to your name; it significantly bumps your earning potential.
-
Junior Security Analyst: $75,000 - $90,000
-
CPSA Certified Professional: $95,000 - $115,000
-
Senior Pentester (with CRT/CPSA): $130,000+
By spending $400 today, you are positioning yourself for a salary increase that can range from 15% to 30% within the first year of certification.
CREST CPSA Certification Requirements
Before hitting the "book now" button, you need to ensure you meet the CREST CPSA certification requirements. While there are no formal "years of experience" mandates, CREST recommends at least 6-12 months of experience in technical security or networking.
Recommended Prerequisite Knowledge:
-
Networking Fundamentals: Deep understanding of TCP/IP, DNS, and DHCP.
-
Command Line Proficiency: Comfort with both Windows CMD/PowerShell and Linux Bash.
-
Basic Security Principles: Knowledge of the CIA triad, risk management, and common vulnerabilities.
You must also sign the CREST Code of Ethics. CREST places a heavy emphasis on professional integrity; any breach of these ethics can result in the permanent revocation of your credentials.
Deep Dive into CREST CPSA Exam Syllabus
To dominate the exam, you need to dissect the official CREST CPSA syllabus. The exam covers distinct domains. Let's break down the most critical areas where candidates often struggle.
Soft Skills and Assessment Management
This isn't just about hacking; it's about business. You will be tested on:
-
Engagement Lifecycle: Scoping, execution, and reporting.
-
Legal Frameworks: Understanding the Computer Misuse Act (or regional equivalents) and GDPR.
-
Ethical Conduct: How to handle sensitive data during a test.
Core Technical Skills
Expect heavy questions on the OSI model and IP networking. You must be able to identify:
-
Common port numbers (e.g., 21, 22, 25, 53, 80, 443, 3389).
-
The difference between TCP and UDP headers.
-
IP subnetting and CIDR notation.
Cryptography
You don't need to be a mathematician, but you do need to understand the application.
-
Symmetric vs. Asymmetric: When to use AES vs. RSA.
-
Hashing: Understanding MD5, SHA-256, and salts.
-
PKI: How certificates and CAs work in a web environment.
Background Information Gathering
This covers Open Source Intelligence (OSINT).
-
Google Dorking: Using advanced search operators.
-
Whois & DNS: Extracting information from records (A, MX, TXT, NS).
-
Tooling: Knowledge of tools like theHarvester or Maltego (conceptually).
Networking Equipment
Can you identify a misconfigured router?
-
VLAN Hopping: How it works and how to prevent it.
-
Firewall Rules: Understanding egress vs. ingress filtering.
-
SNMP: Identifying the risks of using public/private community strings.
Microsoft Windows Security Assessment
This is a major part of the exam. Focus on:
-
Active Directory: Users, groups, and GPOs.
-
Windows Authentication: NTLM vs. Kerberos.
-
Registry & Permissions: Identifying weak ACLs.
Unix Security Assessment
Similar to Windows, but Linux-focused:
-
File Permissions: Understanding chmod (e.g., 755, 644) and SUID/SGID bits.
-
Logging: Knowing where /var/log/auth.log or /var/log/messages reside.
-
SSH Hardening: Disabling root login and using keys.
Web Testing Methodologies & Techniques
Expect questions aligned with the OWASP Top 10.
-
Injection: SQLi, Command Injection, and XSS.
-
Broken Authentication: Session hijacking and cookie security (Secure/HttpOnly flags).
-
IDOR: Insecure Direct Object References.
Databases
You must understand how to interact with and secure SQL and NoSQL databases.
-
Default Credentials: The primary reason for database breaches.
-
Hardening: Removing xp_cmdshell in MS SQL.
The syllabus is broad. Use the CREST Technical Syllabus as your checklist. If you can't explain a topic to a peer, you aren't ready to test on it.
Study Tools That Work
Success in the CPSA isn't about memorizing a textbook; it’s about active recall and practice.
Use Practice Exams
The most effective way to prepare is by using a CREST CPSA practice exam. Practice tests help you:
-
Get used to the 1-minute-per-question pace.
-
Identify "knowledge gaps" in specific domains like Cryptography or Unix.
-
Lower exam-day anxiety by familiarizing yourself with the phrasing of CREST CPSA certification questions.
Hands-On Labs
Even though the CPSA is a theory-based multiple-choice exam, the questions are often "scenario-based." You should spend time in:
-
TryHackMe/HackTheBox: Focus on the "Pre-Security" and "Junior Pentester" paths.
-
Build a Home Lab: Set up a Windows Server VM and a Linux VM to practice checking permissions and configurations.
Recommended Reading
-
The Web Application Hacker’s Handbook (For Web Domains).
-
Network Security Assessment by Chris McNab.
Career Impact: Life After CPSA
What happens after you see "PASS" on the screen?
-
Immediate Credibility: You can use the CREST logo on your LinkedIn and resume.
-
Pathway to CRT: You are now eligible to sit for the CREST Registered Tester exam, which is a practical, hands-on assessment.
-
Recruitment Magnet: Recruiters specifically filter for "CREST" when looking for penetration testers for Tier 1 firms.
The CPSA acts as a filter. It tells employers, "This candidate understands the fundamentals of a professional, ethical security assessment."
Final Thoughts
The journey to becoming a CREST Practitioner Security Analyst is challenging but immensely rewarding. By mastering the domains, investing in the right CREST CPSA certification resources, and practicing with realistic exam simulations, you aren't just passing a test - you are building a foundation for a lifelong career in cybersecurity.
Are you ready to leap? Start by reviewing these CREST CPSA sample questions to see where you stand today.
FAQs
How long does it take to prepare for the CREST CPSA?
-
Most candidates with a basic networking background require 2 to 3 months of consistent study. If you are already working in security, you might be ready in 4 to 6 weeks.
Is the CREST CPSA exam hard?
-
It is considered intermediate. The difficulty lies in the breadth of the syllabus rather than the depth of any single topic. You must be a "jack of all trades" across Windows, Unix, and Web.
Can I take the CPSA exam online?
-
No, the CREST CPSA is currently proctored via Pearson VUE physical testing centers to ensure the integrity of the certification.
What is the difference between CREST CPSA and CRT?
-
The CPSA is a theoretical, multiple-choice exam. The CRT (CREST Registered Tester) is a practical, hands-on exam. You must pass the CPSA before you can attain the CRT designation.
How much does the CREST CPSA cost in other currencies?
-
While the standard price is $400 USD, it is often localized (e.g., ~£300 in the UK or ~€350 in Europe), depending on the Pearson VUE region.
Does the CREST CPSA expire?
-
Yes, the certification is valid for three years. To remain certified, you must retake the exam or progress to a higher level of CREST certification.
