ISTQBCertified Tester Security Test Engineer
The ISTQB® Certified Tester Security Test Engineer (CT-STE) certification equips testing professionals with the engineering-focused skills to plan, perform, and evaluate security tests across the software development lifecycle. It covers security methodologies, standards, techniques, processes, and tools, enabling you to identify vulnerabilities and protect systems against evolving cyber threats. This certification is for anyone involved in testing IT-based systems for security, from testers and analysts to developers and managers.
1355 practice questions · Updated 2026-07-30
9Domains
49Objectives
331Concepts
1355Questions
CT-STE Curriculum
Every domain, objective, and concept the CT-STE exam measures.
- Asset Identification
- Asset Valuation
- Protection Level Determination
- Security Controls Mapping
- Risk-Based Protection
- Information Sensitivity Classification
- Data Handling and Protection Requirements
- Security Testing in Sensitive Environments
- Security Audit Fundamentals
- Audit Objectives and Scope
- Audit Process and Phases
- Audit Evidence Collection
- Audit Reporting and Follow-up
- Security Testing Fundamentals
- Security Testing Techniques
- Security Testing in SDLC
- Differences Between Audits and Testing
- Zero Trust Definition
- Core Principles of Zero Trust
- Zero Trust Architecture Components
- Zero Trust vs Traditional Security
- Implementation Considerations
- Zero Trust Fundamentals
- Zero Trust Architecture Components
- Zero Trust in Security Testing
- Testing Zero Trust Controls
- Zero Trust Threat Modeling
- Zero Trust Compliance and Best Practices
- Definition of OSS
- Common OSS licenses
- Security benefits of OSS
- Security risks of OSS
- Impact on security testing strategy
- Testing OSS components
- Definition of Black-Box Security Testing
- Definition of White-Box Security Testing
- Definition of Grey-Box Security Testing
- Comparison of Black-Box, White-Box, and Grey-Box Testing
- Advantages and Disadvantages of Each Testing Approach
- When to Use Each Testing Approach
- Static Security Testing
- Dynamic Security Testing
- Static vs. Dynamic Testing
- Static Analysis Techniques
- Dynamic Analysis Techniques
- Tools for Static Testing
- Tools for Dynamic Testing
- Integrating Static and Dynamic Testing
- Risk-Based Test Design
- Threat Modeling in Test Design
- Security Test Objectives Derivation
- Attack Surface Analysis
- Security Test Data Selection
- Security Test Environment Setup
- Security Test Coverage Criteria
- Traceability of Security Tests to Risks
- Security Test Prioritization
- Incorporating Security into Test Design Documents
- Recertification testing definition
- Reconciliation testing definition
- When to perform recertification testing
- When to perform reconciliation testing
- Differences between recertification and reconciliation testing
- Planning recertification testing
- Planning reconciliation testing
- Executing recertification testing
- Executing reconciliation testing
- Reporting and follow-up actions
- Identification concepts
- Authentication mechanisms
- Authorization models
- Testing identification
- Testing authentication
- Testing authorization
- Interplay of IAA
- Encryption Fundamentals
- Symmetric Encryption
- Asymmetric Encryption
- Hybrid Encryption
- Encryption Strength and Key Length
- Encryption in Transit
- Encryption at Rest
- Key Management
- Common Encryption Vulnerabilities
- Testing Encryption Implementation
- Purpose of protective technologies
- Types of protective technologies
- Testing firewall configurations
- Testing intrusion detection and prevention systems
- Testing antivirus and malware protection
- Testing encryption implementations
- Testing access control mechanisms
- Testing security logging and monitoring
- Testing configuration and patch management
- Interpreting test results and reporting
- Security Test Process Overview
- Security Test Planning
- Security Test Design
- Security Test Execution
- Security Test Evaluation and Reporting
- Security Test Closure
- Security Test Environment Definition
- Environment Components
- Environment Isolation
- Environment Configuration
- Test Data Management
- Tooling and Infrastructure
- Environment Setup and Maintenance
- Environment Documentation
- Security Test Design at Component Level
- Component-Level Security Test Objectives
- Threat and Risk Analysis for Components
- Security Test Design Techniques for Components
- Security Test Cases for Components
- Component Security Test Environment and Tools
- Coverage and Traceability in Component Security Testing
- Documentation and Reporting of Component Security Tests
- Security Test Design at Component Integration Level
- Integration-Level Threat Modeling
- Interface Security Analysis
- Security Test Case Derivation for Integration
- Component Interaction Security Testing
- Integration-Level Security Test Techniques
- Prioritization of Integration Security Tests
- Traceability of Integration Security Tests
- System Testing in Security Context
- Acceptance Testing in Security Context
- Security Test Objectives in System Testing
- Security Test Objectives in Acceptance Testing
- Planning System Security Tests
- Planning Acceptance Security Tests
- Executing System Security Tests
- Executing Acceptance Security Tests
- Evaluating System Test Results
- Evaluating Acceptance Test Results
- ISTQB CT-STE Standards Overview
- ISO/IEC 25010 Quality Model
- ISO/IEC 27001 Information Security Management
- OWASP Testing Guide
- NIST Standards and Guidelines
- PCI DSS and Industry-Specific Standards
- Applying Standards in Test Planning
- Identify relevant industry standards
- Understand standard applicability
- Apply standards to testing activities
- Compare and contrast standards
- Mandatory Application Overview
- Regulatory and Compliance Frameworks
- Application of Standards in Test Processes
- Documentation and Traceability
- Audit and Conformance
- Voluntary Application Definition
- Benefits of Voluntary Application
- Context for Voluntary Application
- Implementation Considerations
- Evaluation and Improvement
- Identify standards and best practices as test oracles
- Extract test oracles from security standards
- Extract test oracles from best practices
- Apply standards-based oracles to security testing
- Apply best-practice-based oracles to security testing
- Compare and contrast standards and best practices as oracles
- Identify Standards and Best Practices
- Explain Benefits of Standards
- Explain Drawbacks of Standards
- Compare Standards vs. Best Practices
- Apply Standards in Context
- Evaluate Trade-offs
- Organizational Structures in Security Testing
- Impact of Structure on Security Testing Activities
- Roles and Responsibilities in Security Testing
- Adapting Security Testing to Organizational Context
- Regulatory Frameworks Overview
- Compliance Requirements in Testing
- Impact on Test Strategy
- Data Protection and Privacy
- Industry-Specific Regulations
- Regulatory Reporting and Documentation
- Regulatory Changes and Maintenance
- Common Attack Scenarios Overview
- Attack Vectors and Entry Points
- Attack Lifecycle and Phases
- Scenario-Based Threat Modeling
- Real-World Attack Case Studies
- Mitigation and Defense Strategies
- Hacker Mindset
- Reconnaissance
- Scanning and Enumeration
- Gaining Access
- Maintaining Access
- Covering Tracks
- Attack Lifecycle
- Incident Response Process
- Incident Detection and Triage
- Evidence Collection and Preservation
- Root Cause Analysis
- Post-Incident Reporting
- Lessons Learned and Process Improvement
- Sequential Development Models Overview
- Security Testing in Sequential Models
- Requirements Phase Security Testing
- Design Phase Security Testing
- Implementation Phase Security Testing
- Testing Phase Security Testing
- Maintenance Phase Security Testing
- Advantages and Disadvantages for Security Testing
- Agile principles and values
- Agile roles and responsibilities
- Agile ceremonies and security integration
- Security testing in Agile iterations
- Adapting security test strategies to Agile
- Handling changing requirements
- Collaboration and communication in Agile security testing
- Automation in Agile security testing
- DevOps Principles
- DevOps Practices
- DevOps Toolchain
- Security in DevOps
- Testing in DevOps
- Impact on Testers
- Security Regression Testing Definition
- Security Confirmation Testing Definition
- Distinguishing Regression and Confirmation Testing
- Selecting Security Regression Test Cases
- Automating Security Regression Tests
- Executing Security Regression and Confirmation Tests
- Analyzing and Reporting Results
- Integrating with Development Lifecycle
- Definition of Acceptance Criteria
- Sources of Acceptance Criteria
- Characteristics of Good Acceptance Criteria
- Writing Acceptance Criteria
- Acceptance Criteria vs. Test Conditions
- Verification of Acceptance Criteria
- Acceptance Criteria in the Testing Process
- ISMS Purpose and Components
- ISMS Inputs from Security Testing
- Risk Management Integration
- Control Effectiveness Evaluation
- Incident Management Support
- Continuous Improvement Cycle
- Compliance and Audit Evidence
- Stakeholder Communication
- ISMS Overview
- ISMS and Security Testing Relationship
- Risk-Based Approach in ISMS
- Integrating Security Testing into ISMS Processes
- Holistic Security Testing Strategy
- Stakeholder Communication in ISMS
- Define measurable security testing objectives
- Identify security testing metrics
- Establish baselines for security testing
- Use metrics for continuous improvement
- Report security testing results
- Security Test Report Structure
- Risk-Based Reporting
- Communicating Findings to Stakeholders
- Metrics and KPIs in Security Testing
- Recommendations and Remediation Guidance
- Vulnerability Identification
- Vulnerability Analysis
- Risk Assessment
- Vulnerability Classification
- Evidence Collection
- Reporting Vulnerabilities
- Vulnerability Reporting
- Responsible Disclosure
- Reporting Channels
- Severity and Impact Assessment
- Mitigation and Remediation Guidance
- Documentation and Communication
- Vulnerability Definition
- Vulnerability Identification
- Vulnerability Avoidance Strategies
- Secure Coding Practices
- Security Requirements Analysis
- Threat Modeling for Avoidance
- Security Testing in Early Phases
- Vulnerability Reporting and Documentation
- White-box security test tools overview
- Static Application Security Testing (SAST) tools
- Source code analysis techniques
- Tool capabilities and limitations
- Integration with development lifecycle
- Tool selection criteria
- Black-box security test tools overview
- Types of black-box security test tools
- Vulnerability scanners
- Fuzzers
- Web application security tools
- Network security tools
- Tool selection criteria
- Limitations of black-box tools
- Grey-box testing fundamentals
- Grey-box test tool categories
- Tool selection criteria
- Tool configuration and usage
- Interpreting tool results
- Static Analysis Fundamentals
- Tool Categories and Selection
- Integration into Development Workflow
- Interpreting Tool Results
- Limitations and Bypass Techniques
- Tool Configuration and Customization
- Dynamic Analysis Fundamentals
- Dynamic Testing Techniques
- Dynamic Testing Tools Categories
- Tool Selection Criteria
- Tool Limitations and Risks
- Interpreting Dynamic Test Results
- Tool Selection Criteria
- Tool Evaluation Process
- Tool Integration Considerations
- Tool Support and Maintenance
- Tool Licensing and Cost
- Tool Training and Usability
- Static Security Test Tools Overview
- Static Analysis vs. Dynamic Analysis
- Types of Static Security Test Tools
- Static Analysis Techniques
- Interpreting Static Analysis Results
- Integrating Static Tools into Development
- Limitations and Challenges
- Dynamic Test Tools Overview
- Dynamic Analysis Techniques
- Fuzzing Tools
- Web Application Scanners
- Penetration Testing Tools
- Network Vulnerability Scanners
- Interception Proxies
- Dynamic Tool Limitations
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for CT-STE, so none is invented.