Certification Examination details

In order to become CREST Consultants, candidates must pass the CREST Certification Examination.

The Certification Examination is administered by CREST, and comprises two components: a written component and a practical component. Components will be sat consecutively, with an hour break for lunch, and the overall examination will last a day. There are two parallel tracks of CREST Certification Examination:

- The Infrastructure Certification Examination, which assesses candidates' capabilities in the field of general infrastructure and operating system security assessments; and

- The Web Application Certification Examination, which assesses candidates' capabilities in the field of web application security assessments.

The written component of both tracks of the CREST Certification Examination will comprise ninety (90) multiple choice questions, all of which the candidate must complete. In addition the candidate will be presented with five (5) longer form questions, of which the candidate must choose and complete three (3). The written component will last 2 and a half hours in total.

The practical component of both tracks of the CREST Certification Examination will comprise a series of questions, split into structured tasks to be carried out against the CREST certification system. Questions and tasks are designed to examine fundamental infrastructure or web application penetration testing skills, and candidates will be required to complete all of them.

CREST Certification Examination Availability

The table below shows the dates in 2008 for which CREST are taking bookings for either the CREST Infrastructure Certification Examination or the CREST Application Certification Examination.

The Technical Syllabus, Notes for Candidates and Examination(s) Booking forms are available for download here:

CREST Technical Syllabus Version 1.0

CREST Notes for Candidates Version 1.0

CREST Examination Booking Form

Other technical specialisation examinations

CREST plan to introduce additional specialisation examinations in the future to test candidates' capabilities in additional areas of technical information security. We are consulting with our Industry Advisory Panel to determine what form the specialisation examinations will take, and what areas they will cover.