CREST Practitioner exam — oral vs written, which part is actually harder?
Sitting my first CREST exam in about 10 weeks and I'm trying to figure out how to split prep time between the written knowledge component and the practical oral assessment. Everything I've read says the oral section is where candidates get eliminated, but personally I find the written questions harder because of how granular the technical depth gets.
Background: 4 years in pentesting, mostly web app and infrastructure work. I hold CEH and OSCP and have done a fair number of CTFs. The CREST syllabus feels more focused on depth of explanation than those — they want you to articulate methodology and reasoning out loud, not just prove you can execute a technique on a box.
Right now I'm doing 1.5 hours daily on written prep and one mock verbal walkthrough per week with a colleague who's already CREST certified. Is that enough, or am I underweighting the oral component? Any sense of which topic areas assessors tend to probe hardest?
Mock orals with a certified colleague is the best prep you can do by far. My colleague grilled me for 45 minutes twice a week for a month and it made a bigger difference than any amount of written study. Being able to explain things clearly under pressure is a distinct skill.
Passed CREST Practitioner last year. The written section has specific questions on protocols and vulnerabilities that go deeper than OSCP material — make sure you know your TCP/IP stack and web fundamentals at a granular level, not just a working level.
The oral section trips people up mainly because pentesters are used to doing the work, not explaining it in real time. Practice talking through your methodology out loud even during solo prep — it feels awkward but it's exactly what the assessment tests.
10 weeks is workable but tight given the breadth of the CREST syllabus. If you can stretch to 12–14 weeks you'll go in significantly less stressed. The preparation you're doing sounds solid though.
Honestly, I almost bailed three weeks before mine. The written questions were killing my confidence and I kept second-guessing whether I'd ever actually pass. But here's the thing nobody tells you upfront: the written section rewards grinding. I found free crest security vulnerability management practice questions and just hammered them until the patterns clicked. It's repetitive but it works.
The oral threw me at first because I wasn't used to thinking out loud under pressure. You know the concepts, but articulating your methodology to an examiner who's actively probing your reasoning is a different skill. What helped me was doing mock walkthroughs with a colleague, just narrating my thought process on random scenarios until it felt natural. Don't neglect the written though -- I've seen people underestimate it and get caught out. They're both passable, you just need to respect each one differently.
Just passed mine last month so I'll share what actually clicked for me. The written isn't easy but it's more predictable — you can grind practice questions and know roughly what's coming. I spent a few hours on free crest security vulnerability management questions and it genuinely helped me feel less lost going in. The oral is a different beast entirely though. It's not testing if you memorized the right answer, it's testing whether you think like a practitioner under pressure.
The thing that made the difference for me was doing mock orals out loud, not just in my head. Sounds obvious but I wasn't doing it until about three weeks out and it changed everything. Get someone to throw scenarios at you and force yourself to talk through your reasoning step by step. That's what the assessors are actually listening for — your process, not just your conclusion. Ten weeks is enough time if you split it roughly 40/60 written to oral prep, and don't leave the verbal practice until the last week like I nearly did.
Honestly, I was in the same boat as you about three months ago. I work full time in a SOC and was squeezing prep in during lunch breaks and a couple evenings a week, so I had to be brutal about where I put my time. The written stuff felt harder to me at first because there's just so much ground to cover, but once I started doing proper mock labs for the practical side I realised why everyone says the oral is where you can actually fail. You can memorise methodology all you want but when someone's grilling you in real time and asking you to justify every decision you made, that's a different skill entirely.
What worked for me was treating the oral like a verbal debrief after every practice session, even if it was just me talking through what I did and why. It felt stupid at first but it genuinely helped. Don't underestimate the written either though, some of those questions are sneaky, but if you're already working in the field you've probably got more foundation than you think. Ten weeks is tight but doable if you're consistent.