最新的CREST Certified Red Team Manager - Multiple Choice Long Form - CCRTM-MCLF免費考試真題

A. The Blue Team should always be part of the Control Group for efficiency

B. Segregation exists purely to reduce headcount costs

C. Maintaining this segregation is what allows the Blue Team to remain genuinely unaware of the live test, preserving the realism and validity of the assessment of detection and response capability

D. Segregation has no real governance purpose and is merely traditional practice

A. Version history is only relevant to software development documents, not RoE documents

B. A clear version history and change log provides an auditable record of exactly what rules applied at any given point during the engagement, which is important given that the RoE may be legitimately updated over the course of a lengthy engagement

C. Version history exists solely to track the provider's billing history

D. Version history has no practical value and is included purely as a formality

A. RoE compliance is optional for staff who personally disagree with a specific rule

B. Only the most senior consultant on the engagement needs to comply; junior staff are exempt

C. Every individual involved in delivering the engagement - regardless of seniority, including subcontractors - must understand and comply with the agreed RoE

D. RoE compliance only applies during the specific hours defined as the "core" testing window, with no obligations outside that window

A. Constraints exist solely to protect the client, with no relevance to the provider

B. Documenting them clarifies the conditions the engagement is planned around (e.g., available environments, resourcing, timing) and any known limitations, reducing the risk of later disputes or misunderstandings about what was actually agreed

C. Assumptions and constraints have no practical value and are typically omitted

D. Assumptions are only relevant to the provider's internal planning, never shared with the client

A. Status calls should only occur if a serious incident has already happened

B. Regular status calls have no governance value and are purely a courtesy

C. Status calls should include the Blue Team, to keep them informed of progress

D. Regular status updates support ongoing oversight, allow early identification of emerging issues or risks, and maintain the Control Group's ability to exercise informed, timely governance throughout the engagement, not only at its start and end

A. These elements are unrelated administrative burdens with no coherent shared purpose

B. These elements exist solely to benefit the client, with no protective value for the provider

C. Only written authorisation matters; the others are optional extras

D. Together, they form a coherent risk management and legal protection framework that clarifies what is authorised, protects personal data and sensitive information, and allocates financial/legal risk appropriately between the parties

A. Reports are never shared with legal counsel under any circumstances

B. Reports have no particular legal sensitivity beyond any other business document

C. Legal privilege can never apply to any cybersecurity-related document

D. Because a report may detail exploitable vulnerabilities and evidence of weaknesses that, if disclosed inappropriately (including in litigation or regulatory proceedings), could create significant risk, some organisations manage such reports through legal counsel to consider privilege protections where appropriate

A. To repeat the entire 12-week Red Team phase

B. To negotiate the Red Team provider's final invoice

C. To publicly shame the Blue Team for missed detections

D. To collaboratively walk through the attack timeline so the Blue Team understands what happened and both teams can identify concrete detection and response improvements

A. Without rigorous, well-analysed, genuinely plausible threat intelligence, the resulting "simulated attack" would not authentically reflect real-world risk, undermining the fundamental premise that distinguishes intelligence-led testing from generic penetration testing

B. Threat intelligence matters only for the written report, with no bearing on the actual conduct of testing

C. Threat intelligence is a peripheral, optional add-on with little real bearing on these frameworks' credibility

D. Any threat intelligence, however weak or poorly sourced, is equally suitable for scenario design

A. Insurance coverage should be periodically reviewed and adjusted to remain appropriate to the practice's actual, current risk exposure as its client base, engagement complexity, and potential liability grow

B. Insurance coverage is entirely irrelevant to management decision-making

C. Insurance requirements are identical for every red team practice regardless of size or client profile

D. Insurance coverage, once set, never needs to be reviewed regardless of how the business or its engagements change over time

A. Grey hat testing is always legal as long as no data is actually stolen

B. Authorisation is irrelevant to criminal liability under these laws

C. There is no difference; both carry identical criminal liability risk

D. A properly authorised engagement, with documented authorisation from someone entitled to grant it and activity kept within agreed scope, is designed specifically to avoid meeting the "unauthorised" element of the relevant offences, whereas unauthorised "grey hat" testing (even with good intentions) risks meeting that element and incurring genuine criminal liability

A. They execute the technical exploitation activity on behalf of the Red Team

B. They have no interaction with the national TIBER Cyber Team

C. They quality-assure the process, validate adherence to scope and the framework, and make a recommendation on whether attestation should be granted

D. They are the same individual as the Control Team Lead