Last updated July 29, 2026
The ISTQB Certified Tester Security Test Engineer (CT-STE) exam is 40 questions worth 43 points; the pass mark is 28 points, which is 65.1%, and the time limit is 75 minutes — 94 minutes if you sit the exam in a language that is not your native one, because ISTQB grants a 25% extension. The questions are not equally weighted: 24 are K2 and 13 are K3 at one point each, and 3 are K4 at two points each. There are no K1 questions at all. The current syllabus is version 1.0.1 dated 31 January 2025 (v1.0 was published on 18 October 2024, and ISTQB describes the certification as released in January 2025); it covers nine chapters and 1290 minutes — 21.5 hours — of recommended training time. The only formal entry requirement is a valid ISTQB Foundation Level certificate.
CT-STE is written for testers who already work on security testing inside a normal delivery team, or who are moving into that role — not for penetration-testing specialists. The syllabus expects you to plan, design and report security tests, to choose between categories of security tools, and to fit that work into an organisation's development lifecycle and its information security management system. Zero trust is the paradigm it keeps returning to (25 mentions across the syllabus) and OWASP is the body of guidance it leans on hardest (39 mentions). If your goal is hands-on exploitation, this is the wrong exam. If your goal is to be the person who owns security testing on a project, it is the right one.
One of ISTQB's own detailed exam-structure tables contains a row reading "TOTAL 120 minutes for 40 questions" for CT-STE. That row is an artefact, and people are planning their preparation around it. The summary exam-structure table (v1.18) and the official CT-STE certification page agree with each other on 75 minutes, or 94 with the non-native-speaker extension. There is also an internal check that settles it: the same official material assigns a timing budget of 1 minute per K2 question, 3 minutes per K3 and 4 minutes per K4. With 24 K2, 13 K3 and 3 K4 that is 24 + 39 + 12 = exactly 75 minutes. Plan for 75, not 120. In practice that means slightly under two minutes per question on average, and your K2 answers have to be near-instant so the scenario items get their three or four minutes.
You must hold ISTQB Foundation Level before sitting CT-STE — that is a hard entry requirement stated in the syllabus. Beyond it, nothing: no years of experience, no accredited training course, and no earlier security certification. Note one confusing detail: on its own help page for this certification ISTQB writes "CT-SEC" where it means CT-STE. That is a typo on the board's side, not a hidden second prerequisite.
These are two different certifications and candidates do book the wrong one. CT-SEC (Security Tester, 2016) is 45 questions, 80 points, 52 to pass, 120 minutes, and it requires three years of relevant experience. It is still live and has not been formally flagged as retiring. CT-STE (2025) is the newer and, for almost everyone starting now, the correct path: a modern syllabus covering zero trust, DevSecOps, SAST/DAST/IAST/SCA and ISMS integration, with CTFL as the only prerequisite. There is no grandfathering — holding CT-SEC does not convert into CT-STE, and the two exams are scored differently. ISTQB has also announced a planned CT-STA (Security Test Analyst); as of now it is not released on istqb.org, so it cannot be part of your plan.
ISTQB publishes an official per-chapter breakdown for CT-STE, and its shape is the most useful single fact about this exam: the questions are spread almost evenly across all nine chapters. No chapter dominates — the largest contributes 7 questions out of 40, and most contribute 3 or 4. That removes a strategy that works elsewhere in the ISTQB specialist family; on CT-PT, for example, half the exam sits in one chapter, so you can concentrate your effort there. On CT-STE you cannot. Skipping a chapter costs points you have no way to make up, because there is no chapter large enough to compensate. The exact per-chapter counts are shown in the breakdown alongside this page.
For priorities, use the official recommended training minutes rather than the question counts — they are ISTQB's own numbers, not our guess. Chapters 4, 5 and 6 (standards and best practices; adjusting security testing to the organisational context; adjusting it to SDLC models) carry 195, 195 and 165 minutes, the three most expensive chapters in the syllabus — yet each contributes only 4 questions. That mismatch is the signal: those chapters are where the material is genuinely hard, not merely long, and where the questions that are hard to answer live.
Three K4 questions are worth two points each — 6 points out of 43, or 14% of the exam — and they sit in exactly two places. Two of them come from chapter 5's "Analyzing an Attack Scenario" (learning objective STE-5.3.1), where you are asked to work through a scenario and identify the possible sources and motivations of an attack. The third comes from chapter 6 (STE-6.1.2), analysing how security testing activities are affected by different lifecycle models. Neither can be memorised; both require you to reason over a described situation. With a pass mark of 28 out of 43 your entire margin is 15 points, so losing all three K4 items burns 40% of it before you have answered a single one-point question wrong.
Chapters 1–3 first (135 + 150 + 120 minutes), to build the vocabulary: the CIA triad, asset security levels, security audits, zero trust, open-source component risk; the black-box / white-box / grey-box and static / dynamic classification of security test types; and the security test process from abstract tests through test cases to test procedures, including which test level each design belongs to. Almost half the exam's questions live here and most are K2 — this is your cheapest scoring.
Chapter 4 next (195 minutes, the most expensive chapter): the weakness → vulnerability → attack chain as CWE → CVE → CAPEC, CWSS versus CVSS for prioritisation, STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege), OWASP guidance, and standards and best practices used as sources of test oracles. Only 4 questions, but 3 of them are K3.
Chapter 5 (195 minutes, K4): the impact of organisational structures, the impact of regulation such as GDPR on security policies and how you test for it, and the attacker's approach — passive reconnaissance (public web, Google dorking, social media for spear phishing) versus active reconnaissance (vishing, dumpster diving, port scans, OS fingerprinting, DNS enumeration, vulnerability scanning, OSINT), plus detection through network intrusion detection and log analysis. Practise writing out a complete attack-scenario analysis. Point for point this is the highest-value section on the exam.
Chapter 6 (165 minutes, K4): how sequential, Agile and DevOps/DevSecOps models change security testing, the shift-left rationale, and security regression and confirmation testing after a change — including analysing results to establish the nature of a vulnerability and its technical impact.
Chapters 7–9 last (105 + 135 + 90 minutes): acceptance criteria and feeding results into an ISMS under ISO/IEC 27001; reporting, the confidentiality of findings, and the explicit distinction between hiding a vulnerability and actually avoiding or removing it; and tool categories — SAST, DAST, IAST, SCA, vulnerability scanning, fuzzing and penetration testing. Ten questions between the three chapters, and mostly K2.
Popular security-testing courses spend time on topics the CT-STE syllabus never mentions. SBOM / Software Bill of Materials does not appear in it once. Neither do red teaming, honeypots, SIEM, or Common Criteria. If a study resource is built around those, it is not aligned with this exam, however good it is as security education. What you do need instead is the syllabus's own distinctions: hiding versus removing a vulnerability, authentication versus authorization, why an intrusion detection system only detects what it was told to look for, and why malware scanning only finds what is already known.
Take mock 1 cold, under 75 minutes, with no notes, and treat the resulting score as a real reading. That works because each of our mocks reproduces the official structure exactly: the same nine-chapter split, the same 24 K2 / 13 K3 / 3 K4 mix, K4 items scored at two points, 43 points in total. Your mock score is therefore directly comparable to the 28-point pass mark rather than being a percentage of something else. Then read every rationale, including for the questions you got right. The three mocks are deliberately different in emphasis: mock 1 leans on zero trust, identity and access management, and STRIDE threat modelling; mock 2 on attacker profiling, DevOps pipelines and standards used as oracles; mock 3 on reconnaissance analysis, standards and regression testing. Short, pointed questions about the exam itself are answered on our CT-STE FAQ.
Our questions are original. They are written by hand against the published syllabus and its learning objectives. They are not real exam questions and they are not dumps: nobody distributing genuine ISTQB items is doing so legitimately, and banks built that way go stale the moment the item pool rotates. What we do copy from the real exam is its structure — chapter weighting, K-level mix, scoring scheme and time limit — because that is the part that makes practice predictive.
As of today there are three full CT-STE mocks published, drawn from a pool of 122 questions, and all nine chapters are covered — every chapter also has its own page with explanatory text you can read before attempting its questions. We keep adding, so treat these numbers as a floor rather than a ceiling; the current state is always visible on the CT-STE certification page.