CREST Certified Threat Intelligence Manager (CCTIM) Certification Practice Exam

What Is CREST CCTIM?

CCTIM, the CREST Certified Threat Intelligence Manager, is a senior-level certification for people who lead threat intelligence work. It tests whether you can run an intelligence function: setting requirements, managing collection and analysis, protecting operations and producing intelligence that decision-makers can use.

CREST exams are known for being rigorous, and CCTIM is no exception.

CCTIM Exam at a Glance

There’s no multiple choice to lean on. You need to write clear, structured answers.

What Does CCTIM Test?

• Intelligence requirements: working with stakeholders to define priority intelligence requirements.
• Collection management: sources, legal and ethical limits, and source evaluation.
• Analysis: structured analytic techniques, confidence levels and avoiding bias.
• Operational security: protecting analysts, sources and investigations.
• Intelligence production: strategic, operational and tactical products for different audiences.
• Team and program management: running and improving a CTI function.

Download CREST’s CCTIM syllabus and notes for candidates for the full list.

Who Should Take CCTIM?

Experienced threat intelligence analysts moving into leadership, CTI team leads and managers, and consultants who run intelligence engagements for clients.

How to Prepare

1. Read the syllabus line by line and map each item to your experience.
2. Practise writing. Answer past-style questions in full paragraphs under time limits.
3. Use the intelligence cycle as the backbone for long-form answers.
4. Review legal frameworks for collection in your jurisdiction.
5. Write a sample intelligence product for an executive audience.

Common Mistakes

• Writing technical detail when the question wants a management decision
• Ignoring OPSEC and legal considerations
• Leaving too long between Part 1 and Part 2

Is CCTIM Worth It?

CREST certifications are widely respected, especially in the UK and with government and regulated-sector buyers. CCTIM is one of the few that assesses CTI management, so it stands out for senior intelligence roles.

Booking and Fees

CREST delivers the whole CCTIM exam at Pearson VUE test centres, and you book through Pearson VUE. There’s no practical element, unlike CREST’s penetration testing certifications, so you don’t need to travel to a CREST exam centre. Fees vary by region. CREST’s US price list shows the CCTIM written exam at US$2,425 before tax, so check your own country’s booking page before you plan your budget.

How the Written Parts Feel

Short-form questions test breadth across the syllabus. Long-form answers and the scenario section test whether you can actually lead a threat intelligence function: set requirements with stakeholders, run the intelligence cycle, judge source reliability, handle legal and ethical limits, and brief executives in plain language. After the exam, CREST gives candidates feedback on the general areas where marks were lost, which helps if you need a second attempt.

The CREST Threat Intelligence Ladder

CCTIM is the top rung of three. CREST Practitioner Threat Intelligence Analyst (CPTIA) covers the core skills, CREST Registered Threat Intelligence Analyst (CRTIA) adds working-analyst depth, and CCTIM is aimed at people leading a team that produces intelligence. All CREST qualifications are valid for three years, so schedule your renewal well before expiry.

Related CREST Practice Exams

• CREST Practitioner Threat Intelligence Analyst (CPTIA)
• CREST Registered Threat Intelligence Analyst (CRTIA)

What’s in the CertsArea CCTIM Practice Pack?

• 300 practice questions with explanations across requirements, collection, analysis, OPSEC and production
• PDF plus practice test software for Windows, Mac and mobile
• Free updates for 180 days and instant download

Use them to test knowledge, and practise long-form written answers separately.

Frequently Asked Questions

Is CCTIM multiple choice?

No. It uses short-form, long-form and scenario-based written questions.

How many parts are there?

Two, with Part 2 taken within three months of Part 1.

Where is it taken?

At Pearson VUE test centres.

Who is it for?

Experienced CTI professionals moving into or working in management.

Is there an analyst-level CREST CTI exam?

Yes, CREST also offers threat intelligence analyst certifications.

How should I practise?

Write full answers to scenario questions under timed conditions.

Where do I take the CCTIM exam?

The entire CCTIM exam is delivered at Pearson VUE test centres. There’s no practical element.

How long does CCTIM stay valid?

CREST certifications, including CCTIM, are valid for three years.