ISTQB CT-SEC exam-day guide
ISTQB CT-SEC · Prepare for the day ahead.
Your checklist
Confirm test delivery mode and appointment details
Check your appointment confirmation email for the exact date, start time, time zone, and whether you sit the exam at a test centre or online with remote proctoring. Confirm with the provider which delivery options are available in your country and whether rescheduling is permitted and by when.
Government-issued photo ID matching your registration name
Bring the original ID (passport or national identity card are the safest choices). The name must match the name on your exam registration. Confirm with the provider which ID types are accepted for your delivery mode, since remote proctoring often has stricter rules than a test centre.
Second form of identification if the provider requires it
Some test centres ask for a second ID or a signature-bearing document. This varies by provider and country, so confirm with the provider rather than assuming one ID is enough.
Your exam voucher, booking number, or candidate number
Have the registration or voucher reference ready in case the invigilator or proctor needs to locate your booking. Note the provider may not require it if your ID is on file; confirm with the provider.
Printed or offline copy of key syllabus facts
Prepare a one-page summary of the CT-SEC syllabus areas you find hardest: security testing concepts, risk assessment, security test process, and the security testing techniques and tools named in the syllabus. Use it for final review only; do not bring notes into the exam room, as materials rules vary and must be confirmed with the provider.
Completed timed practice sets, scored and reviewed
Before exam day, work through practice questions under timed conditions and log every wrong answer with the reason. Bring your error log to the final review session; it is more useful than re-reading the syllabus cover to cover.
Glossary of terms you keep confusing
List pairs you mix up, for example vulnerability versus threat versus risk, and verification versus validation of security requirements. Write each in one sentence in your own words so you can recall it quickly under pressure.
Plan for the test environment
For a test centre, know the address, travel time, and parking or transit options, and arrive early. For remote proctoring, test your camera, microphone, browser, and internet connection the day before, and clear your desk. Confirm with the provider the exact workspace and arrival requirements.
Water, a light snack, and rest the night before
Sleep matters more than one more hour of revision. Eat a normal meal before the exam; avoid heavy caffeine if you are already anxious. Check with the provider whether food and drink are allowed at your seat, as rules differ.
A watch or awareness of the on-screen timer
You need to pace yourself. Check whether a wristwatch is permitted in your delivery mode; many providers restrict watches, so plan to rely on the on-screen timer and confirm with the provider.
Plan the day
Switch from learning to retrieval. Re-read your error log and glossary, then do one or two full timed practice sets. For each wrong answer, write the correct reasoning in one or two sentences. Spend remaining time on the syllabus areas with the weakest scores, typically risk-based security testing, security test design techniques, and the role of security testing across the lifecycle. Stop adding new material in the last 24 hours.
Re-check your appointment time and time zone, confirm the venue or remote session link, and prepare your ID. If you are travelling to a test centre, plan the route and allow buffer time for delays. Confirm with the provider any rules on late arrival, rescheduling, and permitted items.
Do a light review of your one-page summary and glossary only. Prepare clothes, ID, and any permitted items in one place. For remote delivery, run the system check again and confirm the room you will use meets the provider's requirements. Set two alarms. Go to bed at a normal time rather than revising late.
Eat a normal breakfast and avoid cramming new topics. Skim your glossary once. Arrive at the test centre well before the appointment, or log in early for a remote session as instructed. Keep your ID in hand. If something goes wrong with technology or travel, contact the provider immediately rather than waiting.
Read the instructions and note the number of questions and total time. Answer the questions you know first and flag the rest. CT-SEC questions often hinge on precise definitions, so read each stem fully and watch for words like 'most likely', 'first', or 'primary'. Do not leave answers blank if there is no penalty for guessing; confirm the scoring rule with the provider.
Return to flagged questions and eliminate clearly wrong options before choosing. For scenario questions, identify the risk, the asset, and the control being tested, then match to the technique or activity the syllabus associates with it. Keep an eye on the timer so you reserve a few minutes at the end.
Check that every question has an answer and that flagged items were revisited. Submit only when you are satisfied. Note the provider's rules on leaving the session early and on what you may take with you; confirm with the provider if unclear.
Note which topics felt uncertain while they are fresh, since that record helps if you need to retake. Ask the provider when and how results are issued and what the retake policy is.
Rules to check
Bring original government-issued photo ID whose name matches your registration exactly. Copies, expired documents, and nicknames are commonly rejected; confirm with the provider which document types are accepted for your delivery mode.
Arrive or log in before your appointment time. Providers set their own cut-off for late arrival and may refuse entry or charge a fee; confirm the exact policy with the provider rather than assuming a grace period.
Do not bring unauthorized materials into the exam room. Notes, phones, smart watches, and other devices are typically prohibited and must be stored as instructed. Confirm with the provider what is permitted, including whether a wristwatch or water bottle is allowed.
Breaks are usually limited or unavailable during a timed exam, and leaving the room may end the session. Check the provider's break rules in advance, especially for remote proctoring where leaving the camera view can be treated as a violation.
Scoring is by the provider, not by your test centre. Ask the provider how many questions there are, the pass mark, whether wrong answers are penalized, and when results are released; do not rely on secondhand claims.
Follow all invigilator and proctor instructions. For remote sessions this includes staying in camera view, not speaking to others, and not using unauthorized software. Suspected misconduct can lead to invalidation of your result.
If you need to reschedule or cancel, do so within the provider's stated window. Fees and deadlines vary, so confirm with the provider before your appointment date.
Keep your result confidential until the provider confirms it officially. Do not assume a provisional on-screen score is final; confirm with the provider how and when results are issued.