最新的高品質 CCRTM-MCLF 考試練習題庫

CREST CCRTM-MCLF 考試概覽:

CREST CCRTM-MCLF 考試大綱主題:

最新的 CREST Certified CCRTM-MCLF 免費考試真題：

問題 #1

Which of the following is the most accurate statement about the sequencing of Threat Intelligence and Red Team testing sub-phases within TIBER-EU's overall Testing phase?

A. Threat Intelligence work must complete first, since its output (the Targeted Threat Intelligence Report) forms the basis for the Red Team's scenario planning and execution
B. There is no distinction between these sub-phases
C. Red Team testing always precedes Threat Intelligence work
D. They occur simultaneously with no dependency

問題 #2

Which of the following is the most appropriate way to handle a request to include operational technology (OT) or industrial control systems (ICS) with potential life-safety implications within the scope of a red team engagement?

A. Apply significantly enhanced caution - carefully assess whether live testing is appropriate at all, consider safer alternative approaches (e.g., testing in a representative non-production environment, or a more limited, closely supervised assessment), and involve relevant engineering/safety stakeholders in the scoping decision
B. Allow testing to proceed without informing engineering or safety teams, to preserve realism
C. Include them in the same manner and with the same techniques as standard IT systems, with no special consideration
D. Automatically exclude all OT/ICS systems from every engagement with no further discussion

問題 #3

Which of the following best describes how governance of confidentiality should extend to the Red Team provider's own internal handling of client-sensitive material?

A. Internal governance of confidentiality is unnecessary as long as an NDA has been signed
B. The provider should apply its own robust internal governance - access controls, secure storage, need- to-know restriction, and staff confidentiality training - to protect client-sensitive material to a standard consistent with its contractual and professional obligations
C. Confidentiality governance is solely the client's responsibility to enforce within the provider's organisation
D. Confidentiality obligations apply only to the client, never to the provider's internal practices

問題 #4

What is GBEST generally understood to be?

A. A framework exclusively for testing physical building security
B. An intelligence-led testing framework adapted for UK government and public sector critical systems, conceptually modelled on the CBEST approach
C. A purely financial-sector scheme identical to CBEST
D. A private-sector marketing certification with no government involvement

問題 #5

Which of the following best describes the governance rationale for the internal Red Team provider organisation applying rigorous internal quality assurance review to a report before it is delivered to the client?

A. Internal QA review helps ensure findings are accurate, well-substantiated, clearly communicated, and consistent with agreed scope and professional standards before reaching the client, protecting both report quality and the provider's professional credibility
B. Internal QA review has no bearing on report quality or client trust
C. Internal QA review should only occur if specifically requested by the client
D. Internal QA review exists solely to inflate the reported number of findings

問題與答案：