Specialist certification guide
CT-STE v1.0.1: Security Test Engineer
Consider this qualification when you want to strengthen how you design, execute and report security testing within an agreed organizational context. Check the entry requirements below before you book.
Syllabus: ISTQB CT-STE Syllabus v1.0.1, Exam facts checked: October 4, 2026
Is CT-STE the right certification for you?
Consider this qualification when you want to strengthen how you design, execute and report security testing within an agreed organizational context.
When to choose another route: If you need broader security strategy and already meet its experience criteria, compare CT-SEC. If you are new to development and testing, build that background alongside CTFL before attempting advanced-looking security scenarios.
Exam at a glance
40multiple-choice questions
43total available points
28 / 43minimum passing score in points
75 minstandard exam duration
These figures describe CT-STE v1.0.1. Use the listed point threshold, rather than assuming a fixed number of correct answers on a weighted exam.
Source: Official exam structures and rules. Appointment arrangements and any approved extra time must be confirmed with your provider.
How the exam is weighted
Question count and available points are different measures. Use the chapter allocation to set priorities, then check your own weak learning objectives. Every chapter remains examinable.
| Syllabus chapter | Questions | Points | Question share |
|---|---|---|---|
| 1. Security Paradigms | 6 | 6 | 15% |
| 2. Security Test Techniques | 7 | 7 | 17.5% |
| 3. The Security Test Process | 5 | 5 | 12.5% |
| 4. Security Testing Standards and Best Practices | 4 | 4 | 10% |
| 5. Adjusting Security Testing to the Organizational Context | 4 | 6 | 10% |
| 6. Adjusting Security Testing to Software Development Lifecycle Models | 4 | 5 | 10% |
| 7. Security Testing as Part of an Information Security Management System | 4 | 4 | 10% |
| 8. Reporting Security Test Results | 3 | 3 | 7.5% |
| 9. Security Testing Tools | 3 | 3 | 7.5% |
| Total | 40 | 43 | 100% |
Start your planning with Security Test Techniques, which accounts for 7 of 40 questions. Give additional attention to difficult application and analysis objectives. Question share alone is not a personal study timetable.
Source discrepancy: the official qualification overview and the summary table give 75 minutes, while the detailed chapter table footer says 120. This guide uses 75 minutes and flags the discrepancy. Ask your provider to confirm the duration on your appointment.
Source: ISTQB Exam Structures & Rules Tables v1.19, checked October 4, 2026.
Entry requirements
The syllabus requires CTFL before the Security Test Engineer exam. A background in development, software testing or security testing is recommended. Do not confuse that recommendation with an additional fixed experience requirement.
Also known as: CT STE, Security Test Engineer, Certified Tester Security Test Engineer.
Source: Official syllabus and qualification overview.
What the syllabus covers
Use these chapters to organize your reading. The practice prompts are our editorial guidance. Use the official learning objectives to check the required depth.
Chapter 1: Security Paradigms
Classify a small set of assets and their protection needs. Compare an audit observation with a test result and explain the evidence each can supply.
Chapter 2: Security Test Techniques
Select a security test technique for an explicit risk and context. Discuss what the technique could miss before treating it as a complete approach.
Chapter 3: The Security Test Process
Turn a security objective into a test design with setup, action and expected evidence. Ensure another person could understand the intended observation.
Chapter 4: Security Testing Standards and Best Practices
Explain how standards and good practices inform a test choice. Keep the testable requirement visible rather than using a standard name as the entire justification.
Chapter 5: Adjusting Security Testing to the Organizational Context
Adapt a test approach to an organization’s responsibilities and constraints. Analyze a fictional attack scenario using stated assumptions.
Chapter 6: Adjusting Security Testing to Software Development Lifecycle Models
Place security tests in the relevant lifecycle and maintenance activities. Explain how a delivery model changes feedback opportunities and responsibilities.
Chapter 7: Security Testing as Part of an Information Security Management System
Connect security testing evidence with an information security management process. Identify who needs the finding and how it could support improvement.
Chapter 8: Reporting Security Test Results
Produce a report that distinguishes the observed weakness, its possible impact and the evidence needed to verify remediation.
Chapter 9: Security Testing Tools
Choose tools by their intended evidence and limitations. Validate findings and record the environment rather than treating a scan output as a final conclusion.
Source: ISTQB CT-STE Syllabus v1.0.1. ISTQB and the syllabus authors own the official syllabus. The study prompts above are original editorial guidance.
How to prepare
The suggestions below are our editorial advice, not ISTQB requirements.
- Start with assets and expected protection before listing test techniques.
- Practice turning a security requirement into an observable expected result.
- Keep a clear chain from test setup to observation, evidence and finding.
- Compare tools by the evidence they can collect and the limitations of their results.
Try this study exercise
Invent a role-based document-sharing service with public, internal and restricted files. Define the expected access rules, then create tests for allowed and denied actions across roles. Record the evidence needed to distinguish a denied request from a hidden but still accessible resource. Explain how you would report a finding and verify the fix in an authorized test environment.
A study plan with milestones
Use four passes through the material rather than a guaranteed number of weeks. The pace depends on your experience and available study time. This plan is our editorial recommendation, not an official course duration.
| Pass | Focus | Evidence of progress |
|---|---|---|
| 1. Orient | Read the learning objectives and Security Paradigms, Security Test Techniques, The Security Test Process, Security Testing Standards and Best Practices | A chapter map with terms you can explain and objectives you cannot yet demonstrate. |
| 2. Apply | Adjusting Security Testing to the Organizational Context, Adjusting Security Testing to Software Development Lifecycle Models, Security Testing as Part of an Information Security Management System, Reporting Security Test Results, Security Testing Tools | A traceable security test and vulnerability report, with organizational context, reproducible evidence and a remediation verification plan. |
| 3. Diagnose | Take the matching official sample without looking at the answers | An error log separating missing knowledge, reasoning mistakes and rushed reading. |
| 4. Consolidate | Rework weak objectives and repeat the relevant exercises | A reasoned explanation of corrected answers, plus a confirmed exam version and booking checklist. |
For each uncertain answer, record the learning objective, why your choice seemed plausible, the official explanation and the example you will use to check your understanding again. Revisit guesses even when they happened to be correct.
Use the official sample exams
Take one sample under timed conditions before you open the answers, then review every guess as well as every wrong answer. Our sample exam guide shows how to turn a practice score into a study plan.
Before you book
Confirm the exam version, language and your eligibility with the provider before you pay. Use our booking checklist, the USA and India guides, and the exam day checklist.
Common questions
Is CTFL required for Security Test Engineer?
Yes. Syllabus section 0.4 explicitly requires the Foundation Level certificate before the exam, even though the overview page does not state it prominently.
How long is the CT-STE exam?
The qualification overview and summary exam table agree on 75 minutes. The detailed table has a conflicting 120-minute footer. Confirm the booked duration with your provider.
Is the 28-point threshold the same as 28 correct answers?
Do not make that assumption. The exam has 40 questions and 43 points. Use the point threshold and the scoring guidance for the actual exam.
What should a security test report include?
For preparation, practice explaining the setup, observation, evidence, consequence and limitations, followed by a next action and a way to verify a fix. A tool’s output alone rarely supplies that whole chain.
Related certification guides
Return to the full certification directory →
Fees and booking
Use our exam fees overview to compare exam prices, taxes, retake charges and booking terms. Check the dated fee records in our USA guide or India guide. For other countries, use the member board directory to find the appropriate booking route. Your provider sets the final price and terms, so ask for them before you pay.
Sources and how we checked
Syllabus and exam facts checked on October 4, 2026. Scope summaries are based on the official documents linked below. Decision advice, study routines and the worked exercise are our editorial guidance. Provider availability and booking terms can change.