The Certified Zero Trust Specialist (CZTS) is an advanced, vendor-neutral certification for security engineers, identity and network teams, cloud engineers and architects who have to replace a perimeter with per-session, identity-based access. It validates that you can apply NIST SP 800-207 and the CISA Zero Trust Maturity Model to a real estate: phishing-resistant identity, device posture in policy, micro-segmentation and ZTNA, per-request authorization in applications and data, and the telemetry, automation and governance that hold it together. The exam is computer adaptive and performance-based, and the credential is kept current through continuing education.
| Level | Advanced. A specialist credential: it goes deep on zero trust design and rollout and assumes working security, identity or infrastructure experience. |
|---|---|
| Delivery model | Computer adaptive, three stages. Your score on each stage selects the difficulty of the next, so no two candidates sit the same paper. |
| Format | 120 questions. A performance-based exam that includes performance-based questions and multiple-choice questions. No vendor product knowledge required. |
| Time | 180 minutes for the whole exam, timed. Autosaves every answer. |
| Scoring | You need a score of 700 out of 900 to pass. Results are reported on a scale of 100 to 900, and 700 corresponds to answering 72% of the exam correctly. Harder questions carry more weight, so a score means the same thing on any route. Multiple-response items and PBQs are all or nothing. |
| Retakes | No waiting period after a failed first attempt. Every attempt is paid for at the exam price. See the CertLabz Certification Retake Policy. |
| Voucher validity | 12 months from purchase, for one sitting. |
| Certification validity | 3 years. Renew with 75 CEUs per cycle and the $55 annual CE fee, or pass the current exam. Renewal details. |
| Language | English. |
| Credential | PDF certificate with QR code, public verification page, LinkedIn-ready credential ID. Issuer: CertLabz Certification Board. |
| Free resources | The exam objectives PDF and the ten sample questions PDF. |
| Workforce mapping | NICE Framework work roles: Cybersecurity Architecture (DD-WRL-001), Systems Security Management (OG-WRL-014), Systems Security Analysis (IO-WRL-006). O*NET occupations: Information Security Engineers (15-1299.05), Computer Network Architects (15-1241.00). Self-declared by CertLabz, not reviewed by NIST or CISA. See the full mapping. |
A signed, verifiable:
Of the zero trust certifications we could find, none publishes a hands-on component: one is 60 open-book multiple-choice questions, another is a 75-question vendor product exam, another is a cohort course. The CZTS is a performance-based exam: it includes performance-based questions alongside multiple-choice questions. Instead of only picking A, B, C or D, you rewrite cloud security-group rules into identity-based policy, sequence a segmentation rollout, complete a conditional access table and match detections to automated responses. Theory-only exams cannot tell an employer whether you can run a zero trust program. This one can.
SP 800-207 components, trust algorithms, implicit trust zones and the threats to the architecture itself, applied to real designs.
FIDO2 and passkeys, conditional access, continuous evaluation, token binding, JIT privilege and workload identity.
Flow discovery, labels, monitor mode, default deny, ZTNA connectors, service mesh mTLS and cloud security groups rewritten by identity.
Decision logs, risk scoring, automated revocation, policy as code, maturity self-assessment and the exception register.
Zero trust is now the stated target architecture for United States federal agencies, and enterprises are hiring the engineers and architects who can deliver it across identity, devices, networks, applications and data. Every route is shown here at once, so nothing is hidden behind a control you have to find.
United States pay reported by Glassdoor, checked September 2026. Pay varies by location, employer and experience. No certification guarantees a salary or a job.
| CertLabz CZTS | CSA CCZT | Zscaler ZTCA | Forrester Zero Trust Certification | |
|---|---|---|---|---|
| What it is | Certification exam | Certificate exam | Vendor certification exam | Cohort course with assessment |
| Computer adaptive | Yes | No | No | No |
| Hands-on PBQs | Yes | No | No | Not published |
| Vendor neutral | Yes | Yes | No | Yes |
| Proctored | Yes | No, open book | Not published | Not published |
| Level | Advanced | Foundational | Associate | Practitioner |
| Questions | 120 | 60 | 75 | Not published |
| Time | 180 min | 120 min | 120 min | 60-day cohort |
| Pass mark | 700 of 900 | 80% | Not published | Not published |
| Retake wait | None | Not published | Not published | Not published |
| Exam voucher | $199 | $175 | $300 | $2,260 |
Compiled September 2026 from the Cloud Security Alliance CCZT page and FAQ, the Zscaler certification exam page, and the Forrester Zero Trust Certification page. Product names and trademarks belong to their owners; CertLabz is not affiliated with any of them. Confirm current details with each provider.
Six reasons this credential is worth your time, and worth an employer's attention.
One price for the exam, set by its level. Bundles add the study guide and hands-on practice at a saving.
Secure checkout by Stripe. Prices in USD. Sign in or create a free CertLabz account at checkout.
Every form is drawn from a bank of more than 160 items to these exact weights, whichever adaptive route you take. Filter by the area you want to study.
The exam runs in three stages. Your score on each stage selects the difficulty of the next, so a strong candidate is stretched and a struggling one is measured fairly rather than swamped. No two candidates sit the same paper. Harder questions carry more weight, so a scaled score means the same thing whichever route you took.
Each exam can have up to 5 to 12 performance-based questions, drawn fresh on every attempt, alongside the multiple-choice questions. A PBQ is a task rather than a list: you rewrite security-group rules into identity-based policy, sequence a segmentation rollout, or complete a conditional access or maturity table. They are scored all or nothing, so partial guesses do not pass.
Yes. Questions use NIST SP 800-207, the CISA Zero Trust Maturity Model and open standards such as FIDO2, OIDC, SPIFFE, mTLS and Kubernetes NetworkPolicy. You never need one vendor's console or product names. Where a question involves a broker, proxy or EDR, it is described generically.
700 out of 900. Results are reported on a scale of 100 to 900, and 700 corresponds to answering 72% of the exam correctly.
There is no waiting period between a failed first attempt and a second attempt. Buy another voucher and sit the exam again when you are ready, and it will draw a fresh adaptive form from the bank. See the CertLabz Certification Retake Policy.
Yes, after three years. Keep it current by logging 75 CEUs during the cycle and paying the $55 annual CE fee before expiry, or by passing the current exam again.
The exam objectives PDF and the ten sample questions PDF. The CZTS Official Study Guide is a $50 ebook, included in two of the bundles. Hands-on practice comes with the All Access plan, included in the Complete bundle.
A laptop or desktop with a webcam and microphone, Chrome, Edge or Firefox, a stable connection, and a quiet private room for three hours. Phones and tablets are not supported.
CZTS is a continuing-education certification, like the CE credentials from CompTIA and ISC2. It is valid for three years from the day you pass. To keep it, log 75 continuing-education units during the cycle and pay the $55 annual CE fee before your expiry date. Or pass the current version of the exam again.
CEUs are logged from your CertLabz dashboard with supporting evidence. A certification that lapses can be reinstated only by passing the current exam.
Buy a voucher, study the objectives, sit the exam when you are ready. Your credential is issued the moment you pass.