Security Test Techniques is the classification chapter. It sorts security test types along two axes — black-box / white-box / grey-box and static / dynamic — then applies them to concrete control areas: identification, authentication and authorization, encryption and data protection, and protective technologies such as hardening and firewalls. Along the way it introduces fuzz testing, destructive testing, malware scanning, vulnerability scanning, reconciliation testing and recertification testing.
The specific trap: the syllabus itself warns that this classification has fuzzy overlaps. Candidates who memorise a clean two-by-two grid get burned by scenarios where a technique legitimately sits in two cells at once, and by answers that are wrong only because they claim a boundary is sharp. Read the options for the one that respects the ambiguity rather than the one that looks tidiest.
Study by starting from the risk. Tests here are derived from security risks and threat models, so for each technique fix in mind the threat it addresses and the information it needs about the system — that is what decides the box colour.
Authentication vs authorization — the first establishes who the identity is, the second what that identity may do; distinct tests, distinct defects.
Identification vs authentication — claiming an identity is not proving it.
Reconciliation vs recertification testing — checking that identities and permissions match their records, versus re-confirming that they are still justified.
Vulnerability scanning vs malware scanning — hunting for exploitable weaknesses versus detecting known malicious code.
Fuzz testing vs destructive testing — malformed or random input to trigger unhandled behaviour is not the same intent as deliberately breaking the object.
Grey-box is not "half-hearted white-box" — it is a deliberate choice about how much internal knowledge the test uses.
Static does not mean white-box — the two axes are independent, and the syllabus expects you to combine them, not merge them.
Encryption tested as a control — the question is whether the data is protected in this system, not whether the algorithm is theoretically sound.
This chapter is covered most heavily (7 questions) in CT-STE — Mock Exam 1 (Zero Trust, Access Control & Threat Modelling), CT-STE — Mock Exam 2 (Attacker Profiling, DevOps Pipelines & Standards as Oracles), CT-STE — Mock Exam 3 (Reconnaissance Analysis, Standards & Regression)