About the Exam

ISTQB’s CT-STE certification covers how security testing should be done, including methodologies, standards, techniques, processes, and tools. It is aimed at people involved in testing IT-based systems for security, including testers, test analysts, test managers, developers, and other professionals who need a basic understanding of security testing activities. Passing demonstrates that the candidate can contribute to planning, designing, executing, reporting, and tool selection for security testing.

Exam Topics

  • Security Paradigms10%
  • Security Test Techniques12%
  • The Security Test Process9%
  • Security Testing Standards and Best Practices15%
  • Adjusting Security Testing to the Organizational Context15%
  • Adjusting Security Testing to Software Development Lifecycle Models13%
  • Security Testing as Part of an Information Security Management System (ISMS)8%
  • Reporting Security Test Results10%
  • Security Testing Tools7%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Last updated April 17, 2026 at 4:17 PM

Topic filter
Retired questions
Question sort

QuestionQ1

Security Test Techniques

Which of the following is an example of reconciliation testing?

  • A Reviewing and re-approving employee access to sensitive systems, confirming that users still require the access based on their current job responsibilities
  • B Verifying that access rights of all active user accounts in the company’s HR system match the records in the identity management database
  • C Verifying that access to privileged accounts is reviewed annually to ensure that only authorized personnel retain such access
  • D Checking regularly that user accounts with access to customer data still need this access, ensuring that unneeded privileges are removed
Explanation

Reconciliation testing compares data held in separate systems to confirm that corresponding records agree and to identify discrepancies. Verifying that HR-system access rights match the identity-management database is a reconciliation control.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

Security Test Techniques

Which of the following is an example of firewall testing?

  • A Ensuring that when queried, the system returns data masked or replaced with random characters, verifying that sensitive data is protected from unauthorized users
  • B Using a tool to scan the network and identify open ports, ensuring that only the necessary ports are open and that all other ports are properly blocked
  • C Verifying that the access of the system to the right roles is restricted, services are open only when needed, and application updates are properly monitored
  • D Using “brute force” or “dictionary” attacks to attempt to get plain data from obfuscated data, and performing reverse-engineering of byte code
Explanation

Firewall testing verifies that network access rules allow only the required ports and services while blocking all other unauthorized inbound or outbound connections. A network port scan can confirm that only necessary ports are open and the remaining ports are blocked.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

Adjusting Security Testing to the Organizational Context

Which of the following accurately characterizes the relationship between information sensitivity and security testing?

  • A A popular e-commerce website requires rigorous stress testing, whereas a small personal blog may only need basic testing of login security mechanisms.
  • B A financial application storing customer data requires encryption validation, whereas a public news app may require basic security measures.
  • C A public forum website requires high-level integrity testing whereas an online banking platform primarily needs availability testing to ensure users can log in anytime.
  • D A hospital’s health record system requires minimal security testing since doctors primarily need availability, while a messaging app needs extensive testing to protect conversations.
Explanation

Applications that store sensitive financial customer data require validation that encryption protects that data. Less-sensitive public news applications can generally use a more basic security-control scope. NIST’s cryptographic-module validation program specifically addresses cryptographic protection for sensitive information.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

Security Test Techniques

A tester used rainbow tables in a brute-force attack to uncover user passwords. What type of testing is this?

  • A Testing the authentication mechanism
  • B Testing the accounting mechanism
  • C Testing the authorization mechanism
  • D Testing the system hardening mechanism
Explanation

Using rainbow tables to recover user passwords tests the strength of the authentication mechanism, including password-storage and credential-security controls.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

Security Paradigms

A company enforces a policy in which employees receive access only to the specific systems and data required for their roles, so that no user has more access than necessary. The company also requires employees to use their password and a time-based one-time passcode delivered to their mobile device or an authenticator app to access internal systems. To protect against possible cyber threats, every employee’s laptop, mobile device, and tablet has security software that continuously watches for suspicious activity, such as malware or unauthorized access attempts.

Which Zero Trust concept is MISSING from this scenario?

  • A Security monitoring of device endpoints
  • B Micro-segmentation
  • C Multi-factor authentication
  • D “Least privilege access” principle
Explanation

Micro-segmentation creates granular, isolated network or workload boundaries that restrict connectivity and limit an attacker’s lateral movement. The described controls provide least-privilege access, multifactor authentication, and endpoint security monitoring, but do not describe any segmentation of network access or resources. Microsoft’s Zero Trust networking guidance identifies micro-segmentation as a way to partition infrastructure into isolated segments and reduce lateral movement.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

That's the end of the preview

It's free

100% of the questions are free for all users.
No strings attached.

Topics covered
Security ParadigmsSecurity Test TechniquesThe Security Test ProcessSecurity Testing Standards and Best PracticesAdjusting Security Testing to the Organizational ContextAdjusting Security Testing to Software Development Lifecycle ModelsSecurity Testing as Part of an Information Security Management System (ISMS)Reporting Security Test ResultsSecurity Testing Tools
Know a question that should be here? Contribute to this exam
Back home