ISTQBCertified Tester Security Tester
The ISTQB® Certified Tester Security Tester (CT-SEC) certification validates your ability to plan, perform, and evaluate security tests from multiple perspectives—risk, requirements, vulnerability, and human factors. It is designed for testers with some security testing experience who want to deepen their expertise. Earning it demonstrates that you can align security testing with the software lifecycle, apply security mechanisms, and use the right tools and standards to protect your organization.
1239 practice questions · Updated 2026-07-30
9Domains
49Objectives
278Concepts
1239Questions
CT-SEC Curriculum
Every domain, objective, and concept the CT-SEC exam measures.
- Risk Assessment Fundamentals
- Risk Identification
- Risk Analysis
- Risk Evaluation
- Risk Treatment Options
- Integrating Risk Assessment into Test Planning
- Risk-Based Test Design
- Risk Communication and Reporting
- Definition of Assets
- Asset Identification Process
- Asset Inventory
- Asset Classification
- Asset Ownership
- Asset Value Assessment
- Asset Dependencies
- Asset Lifecycle
- Asset Documentation
- Risk Assessment Fundamentals
- Risk Identification Techniques
- Risk Analysis Approaches
- Risk Evaluation and Prioritization
- Risk Treatment Options
- Risk Assessment Outputs
- Define Security Policies
- Define Security Procedures
- Distinguish Policies from Procedures
- Identify Policy Types
- Understand Policy Compliance
- Apply Policies in Testing
- Security Policy Analysis
- Security Procedures Evaluation
- Gap Identification
- Regulatory Compliance Review
- Risk Assessment Integration
- Recommendation Formulation
- Definition of Security Audit
- Objectives of Security Audit
- Scope of Security Audit
- Types of Security Audits
- Security Audit Process
- Roles and Responsibilities
- Audit Criteria and Standards
- Deliverables of Security Audit
- Difference Between Audit and Assessment
- Importance of Security Audit
- Risk Identification
- Risk Assessment
- Risk Mitigation
- Risk Communication
- People in Security Testing
- Process in Security Testing
- Technology in Security Testing
- Interplay of People, Process, and Technology
- Introduction to Security Testing
- Purpose of Security Testing
- Organizational Context of Security Testing
- Information Assurance vs. Security Testing
- Aligning Security Testing Goals
- Defining Security Test Objectives
- Determining Scope of Security Testing
- Determining Coverage of Security Testing
- Security Test Approaches
- Analysis of Security Test Approaches
- Failures in Security Test Approaches
- Stakeholder Identification
- Improving Security Testing Practices
- ISTQB Security Testing Process
- Aligning Security Testing to Lifecycle Models
- Security Test Planning Objectives
- Key Security Test Plan Elements
- Importance of Planning in Security Testing
- Importance of Approvals in Security Testing
- Security Test Design Fundamentals
- Security Test Design Techniques
- Security Test Design Based on Policies and Procedures
- Effective Security Test Environment Characteristics
- Security Test Environment Setup
- Security Test Execution Monitoring
- Security Test Results Analysis
- Security Test Evaluation Criteria
- Security Test Reporting and Documentation
- Security Test Maintenance Overview
- Identifying Maintenance Triggers
- Updating Security Test Cases
- Retesting and Regression Testing
- Managing Test Assets
- Continuous Improvement of Security Tests
- Lifecycle View of Security Testing
- Security Activities in Each Lifecycle Phase
- Shift-Left and Continuous Security Testing
- Roles and Responsibilities in Lifecycle Security
- Role of Security Testing in Requirements
- Security Requirements Elicitation
- Threat Modeling in Requirements
- Security Risk Assessment in Requirements
- Role of Security Testing in Design
- Security Design Review
- Security Architecture Analysis
- Design-Level Threat Modeling
- Security Test Planning in Design
- Security Testing During Component Testing
- Security Test Design at the Component Level
- Analysis of Security Tests at the Component Level
- Security Testing During Component Integration Testing
- Security Test Design at the Component Integration Level
- Security Testing in System Testing
- Security Testing in Acceptance Testing
- Security Testing in Maintenance
- System Hardening Fundamentals
- Hardening Mechanisms and Techniques
- Testing Hardening Effectiveness
- Assessing Hardening Gaps
- Definition of Authentication
- Definition of Authorization
- Relationship Between Authentication and Authorization
- Authentication Mechanisms
- Authorization Models
- Testing Authentication Effectiveness
- Testing Authorization Effectiveness
- Common Authentication and Authorization Vulnerabilities
- Security Testing Techniques for Authentication
- Security Testing Techniques for Authorization
- Encryption Fundamentals
- Symmetric vs. Asymmetric Encryption
- Common Encryption Algorithms
- Encryption Key Management
- Encryption Implementation Testing
- Common Encryption Vulnerabilities
- Encryption Compliance and Standards
- Firewall Fundamentals
- Firewall Architecture and Placement
- Firewall Rule Analysis
- Firewall Policy Review
- Firewall Configuration Testing
- Firewall Bypass Techniques
- Firewall Logging and Monitoring
- Firewall Performance and Availability Testing
- Intrusion Detection Fundamentals
- Types of Intrusion Detection Systems
- Common Intrusion Detection Tools
- IDS Deployment and Configuration
- Testing IDS Effectiveness
- Evaluating IDS Detection Accuracy
- Bypassing and Evasion Techniques
- IDS Alert Analysis and Reporting
- Malware Scanning Tools Overview
- Tool Capabilities and Limitations
- Deployment and Configuration
- Effectiveness Testing Methodology
- Interpreting Scan Results
- Reporting and Recommendations
- Definition and Purpose of Data Obfuscation
- Common Data Obfuscation Techniques
- Obfuscation in Different Contexts
- Testing Obfuscation Effectiveness
- Assessing Obfuscation Coverage
- Verifying Obfuscation Consistency
- Testing for Reversibility and Leakage
- Evaluating Performance Impact
- Importance of Security Training
- Security Training Objectives
- Security Training Content Areas
- Security Training Delivery Methods
- Security Training Target Audiences
- Metrics for Training Effectiveness
- Testing Methods for Training Effectiveness
- Analyzing Training Test Results
- Continuous Improvement of Security Training
- Human factors in security
- Social engineering
- Phishing and pretexting
- Password hygiene
- Insider threats
- Security awareness training
- Behavioral risk mitigation
- Attacker Mindset
- Attack Motivations
- Attack Planning
- Exploitation Techniques
- Human Factors in Attacks
- Defensive Mindset
- Motivations for attacks
- Sources of attacks
- Human factors in attack vectors
- Attack Scenarios
- Motivations of Attackers
- Human Factors in Attacks
- Impact of Human Factors
- Definition of Security Awareness
- Importance of Human Factors
- Common Human-Related Threats
- Benefits of Security Awareness
- Security Awareness in Testing
- Define security awareness
- Identify human factors in security
- Describe awareness training methods
- Apply awareness in testing
- Security Test Evaluation Fundamentals
- Evaluation of Security Test Results
- Risk-Based Evaluation
- Prioritization of Findings
- False Positive and False Negative Analysis
- Root Cause Analysis
- Evaluation of Security Controls
- Reporting Evaluation Outcomes
- Confidentiality principles
- Handling sensitive test data
- Access control for test results
- Reporting and communication
- Legal and contractual obligations
- Purpose of interim security test status reports
- Components of an interim security test status report
- Interpreting test progress metrics
- Evaluating security findings and their impact
- Communicating interim status to stakeholders
- Identifying deviations from the test plan
- Updating risk assessment based on interim results
- Static Analysis Tools
- Dynamic Analysis Tools
- Penetration Testing Tools
- Vulnerability Scanning Tools
- Fuzzing Tools
- Web Application Security Tools
- Network Security Tools
- Mobile Application Security Tools
- Database Security Tools
- Code Review Tools
- Threat Modeling Tools
- Security Information and Event Management (SIEM) Tools
- Forensic Tools
- Compliance and Audit Tools
- Security Testing Needs Analysis
- Documentation of Security Testing Needs
- Identify common limitations of open source security testing tools
- Assess maintenance and community activity
- Evaluate integration and compatibility challenges
- Analyze scalability and performance constraints
- Recognize licensing and legal risks
- Mitigate risks through tool selection and supplementary measures
- Vendor capability assessment criteria
- Tool functionality evaluation
- Vendor support and maintenance
- Vendor reputation and market presence
- Cost and licensing model
- Integration and compatibility
- Scalability and performance
- Vendor roadmap and innovation
- Trial and proof of concept
- Vendor contract and SLA review
- Identify benefits of security testing standards
- Recognize standards' role in compliance
- Understand standards' impact on quality and efficiency
- Apply standards to improve communication
- Regulatory standards
- Contractual standards
- Differences between regulatory and contractual standards
- Application of standards in regulatory contexts
- Application of standards in contractual contexts
- Impact on security testing activities
- Purpose of security standards
- Common security standards
- Selecting appropriate standards
- Identify Security Standards
- Apply Security Standards
- Understand Standards Impact
- Identify key information security industry trend sources
- Recognize emerging threats and vulnerabilities
- Understand evolving security technologies and practices
- Analyze regulatory and compliance changes
- Evaluate the impact of trends on security testing
- Evaluate security testing practices
- Identify improvement opportunities
- Apply improvement methodologies
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for CT-SEC, so none is invented.
Social Engineering
5 concepts · 25 questions