Security Testing Standards and Best Practices is where the reference material lives: the chain from weakness to vulnerability to attack pattern — CWE (Common Weakness Enumeration) → CVE (Common Vulnerabilities and Exposures) → CAPEC (Common Attack Pattern Enumeration and Classification) — the two scoring systems CWSS and CVSS, the OWASP material, and STRIDE as a systematic way to build a threat model.
Note the imbalance before you plan your revision: this is one of the two heaviest chapters by official study time, and the volume of material is not proportional to how often it is asked. Do not let the acronym lists eat your whole preparation. What is actually examined is application: given a finding, which catalogue or scoring system fits, and what a standard is legitimately used for. The recurring error is treating standards as things to obey rather than as sources of test oracles — they tell you what the expected secure behaviour is.
Learn the chain in one direction and the six STRIDE categories cold; then practise mapping a described defect onto the right layer of the chain.
CWE vs CVE vs CAPEC — a class of weakness, a specific reported vulnerability, and a pattern of attack; three catalogues, three purposes.
CWSS vs CVSS — CVSS scores a vulnerability that already exists in a deployed system; CWSS prioritizes weaknesses before that point.
Mandatory vs voluntary application — whether a standard is imposed on you or adopted by choice changes the consequences of not meeting it.
A standard as an oracle, not as a checklist — it supplies expected results; ticking its clauses is not the same as testing.
Compliance is not security — conforming to a standard demonstrates due diligence, not the absence of vulnerabilities.
STRIDE letters get swapped — in particular repudiation versus information disclosure, and tampering versus elevation of privilege.
OWASP is a body of guidance, not a certification — you apply its practices, you do not "pass" them.
Standards have drawbacks too — the syllabus asks for both sides: a frame you need not invent, but also cost, rigidity and lag behind current threats.
This chapter is covered most heavily (4 questions) in CT-STE — Mock Exam 1 (Zero Trust, Access Control & Threat Modelling), CT-STE — Mock Exam 2 (Attacker Profiling, DevOps Pipelines & Standards as Oracles), CT-STE — Mock Exam 3 (Reconnaissance Analysis, Standards & Regression)