CREST Practitioner Intrusion Analyst

The CREST Practitioner Intrusion Analyst (CPIA) examination is an entry level qualification that tests a candidate’s knowledge all three subject areas of network intrusion, host intrusion and malware reverse engineering at a basic level below that of the Registered and Certified qualifications.

Examination Format
The Examination comprises a multiple-choice written only examination and is a pre-requisite for sitting the CREST Registered Intrusion Analyst examination. Success will confer the CREST Practitioner status to the individual.

You can download the following documents from the links below:

Syllabus for the Practitioner Intrusion Analyst examination
Notes for Candidates to aid examination preparation

The Practitioner Intrusion Analyst examination costs £275 + VAT and is delivered at Pearson Vue test centres.

Recommended Preparation Material
The CREST Assessors panel regularly identifies common themes and consolidates common questions and answers from candidates and from the industry in relation to the CREST certification examinations. Candidates are advised to familiarise themselves with these, although they are free to disregard them if they wish. The latest information can be accessed at

The following material and media has been cited as helpful preparation for this examination by previous candidates:

Reading Material:
Hacking Exposed – Scanning and Enumeration
The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory (by Michael Hale Ligh/Andrew Case/Jamie Levy/Aaron Walters)
Malware Forensic Field Guide for Windows Systems (by Syngress)
Practical Malware Analysis
Network Fundamentals: CCNA Exploration Companion Guide
Real Digital Forensics (particularly chapter 1, Windows Live Response)
TCP/IP Illustrated

Training Courses:
arcX – CREST Approved Training Provider

PGI Cyber Academy – CREST Approved Training Provider


Useful Information for Candidates
How to book
Details of the Logistics and Timings of CREST examinations can be found in the Examination Preparation pages for your country of choice
CREST’s policy for Candidates requiring special arrangements including additional time to accommodate a medical condition (including examinations delivered at Pearson Vue)
Terms and Conditions for CREST Examinations (includes hard disk drive wiping policy)

You can read the CREST Privacy Policy on our website regarding personal data we hold