CCT-APP Exam Information and Outline
CREST Certified Tester - Application
Syllabus Update Checked on: November 6, 2026
CCT-APP Exam Syllabus & Study Guide
Before you start practicing with our exam simulator, it is essential to understand the
official CCT-APP exam objectives. This course outline serves as your roadmap.
The information below reflects the 2026 syllabus defined by
CREST.
Below are complete topics detail with latest syllabus and course outline, that will help you good knowledge about exam objectives and topics that you have to prepare. These contents are covered in questions and answers pool of exam.
- Exam Format
- Written examination and advanced practical web application assessment
- Web Application Architecture and Technologies
- HTTP, frameworks, APIs (REST, SOAP, GraphQL)
- Authentication and Session Management
- Authentication bypass, password policies, SSO, OAuth, JWT
- Access Control
- Horizontal and vertical privilege escalation, IDOR
- Injection Attacks
- SQL, NoSQL, command, LDAP, XXE and SSTI
- Client-Side Attacks
- XSS, CSRF, clickjacking, CORS misconfigurations
- Business Logic, Cryptography and File Handling
- Logic flaws, crypto weaknesses, file upload and deserialisation
- Reporting and Professional Practice
- Risk rating, evidence and remediation advice