Overview
The CREST Certified Tester (CCT) is CREST's advanced penetration testing certification, offered in 2 variants. CCT INF covers infrastructure, including networks, Windows and Linux hosts, Active Directory, desktop lockdown, containers, cloud, and macOS, while CCT APP focuses on web applications, APIs, databases, and related cloud and secure development topics. Each variant has a closed-book written exam with a multiple-choice test and a report-writing scenario, plus a 3-hour practical exam. Both are taken at Pearson VUE centres.
CREST says successful candidates are qualified for penetration testing roles indicative of 5 to 6 or more years of experience, though it calls those timescales recommended rather than mandatory. There are no formal prerequisites. In the UK, the NCSC has approved the CCT exams for CHECK Team Leader status, and the NCSC has set an equivalence between CCT INF and CCT APP and the technical requirements of the UK Cyber Security Council's professional titles. Compared with the CREST Registered Penetration Tester (CRT), the CCT tests a wider skill set and adds scoping, risk analysis, and report writing.
What the exam covers
Each variant has 2 parts, a written exam and a practical exam, which can be taken in either order. The syllabus differs between CCT INF and CCT APP.
| Part |
|---|
| Written exam multiple-choice test on the syllabus areas (1 hour, 60 marks) |
| Written exam scenario on scoping, risk assessment, and report write-up, manually marked (2 hours, 120 marks) |
| Practical exam with hands-on testing of reference networks, hosts, and applications, auto-marked (3 hours, 180 marks in 5 sections) |
| CCT INF syllabus focus: networks, network services, Windows and Linux assessment, desktop lockdown, databases, containers, cloud, virtualization, physical security, and macOS |
| CCT APP syllabus focus: web technologies and APIs, injection and session flaws, databases, cloud, and secure development operations |
Requirements
No prerequisites. CREST describes the level as indicative of 5 to 6 or more years of penetration testing experience and says these timescales are recommended, not mandatory.
- Format
- Closed-book written exam (multiple-choice test and written scenario) plus a practical exam in a provided Kali Linux environment
- Questions
- Written exam 180 marks (60 multiple choice, 120 scenario), practical exam 180 marks (four 30-mark sections and one 60-mark section)
- Time
- Written exam 3 hours and practical exam 3 hours, each with added reading time
- Passing score
- At least 66% in each written component and at least 66% in the practical exam
- Delivery
- Pearson VUE test centres
Candidates can pre-upload files for the practical exam through CRESTDrive, and there's no internet access during the exam. The written scenario is marked by CREST assessors, with results within 20 working days.
Cost
Exam fee: GBP 1,600. CREST lists GBP 1,600 for its Certified-level exams and notes that each comprises 2 parts booked separately. Prices exclude applicable tax, and CREST also accepts USD, EUR, AUD, HKD, and SGD. Prices change, so confirm on the issuer's site. Checked 2026-10-12.
Keeping it current
- Cycle
- 3 years from the date the exam was sat
- Continuing education
- No CPE program published. Renewal is by passing the exam again.
- Fees
- No annual fee published
How to verify that someone holds it
CREST issues CCT INF and CCT APP as Credly digital badges, which anyone can click to check their details and authenticity. Use the issuer’s verification page.
On InfoSecHub, a CCT listed on a profile shows Verified by Credly only when a current Credly badge issued to that person confirms it.
Typical roles
- Senior penetration tester
- Penetration testing team leader
- Application security tester
- Infrastructure security tester
Related frameworks
Official resources
From CREST. Links open the issuer’s site.
- CCT official page, CREST
- CREST Certified Tester - Application (CCT APP), CREST
- CCT INF syllabus, CRESTexam-outline
- CCT APP syllabus, CRESTexam-outline
- CREST digital badges, CRESTverification
References
- CREST Certified Tester - Infrastructure (CCT INF), CREST
- CREST Certified Tester - Application (CCT APP), CREST
- CCT INF FAQs, CREST
- Certifications pricing and booking, CREST
- CHECK Team Leader and Member requirements are changing, CREST
Reviewed 2026-10-12. Exam details, prices, and renewal rules change. Confirm them on the CREST website before you register. InfoSecHub is not affiliated with CREST.