CCRTM-MCLF試験無料問題集「CREST Certified Red Team Manager - Multiple Choice Long Form 認定」

A. Threat Intelligence, Closure, Scoping, Testing

B. Closure, Scoping, Testing, Threat Intelligence

C. Testing, Scoping, Threat Intelligence, Closure

D. Scoping, Threat Intelligence, Testing (Red Team), Closure

A. An executive summary allows senior, non-technical stakeholders (e.g., board members) to quickly understand overall risk, key findings, and business impact, without needing to read the full technical detail

B. Executive summaries are unnecessary, since all readers are expected to understand full technical detail

C. Executive summaries should contain only raw technical vulnerability data with no narrative explanation

D. Executive summaries should be longer than the full technical report

A. Document the exclusion clearly in the Rules of Engagement and scope, and plan the engagement (including any contingency planning) around techniques that will not intentionally cause denial of service, while still pursuing realistic objectives within that constraint

B. Ignore the client's request and use DoS techniques anyway, since they may be realistic

C. Treat DoS exclusion as making the entire engagement pointless and therefore not worth conducting

D. Refuse to proceed with the engagement at all, since DoS exclusion is unacceptable

A. An external recruitment agency

B. The Red Team provider's own staff, on the client's behalf

C. Any employee who happens to be available

D. A person with genuine authority over the systems and data in scope - typically a senior officer such as a director, CISO, or other accountable executive

A. To reduce the risk of a genuine security or emergency response being triggered and to allow rapid de- escalation and correct attribution of activity to an authorised test, should such a response occur

B. Because it transfers full legal responsibility for the test to law enforcement

C. Because law enforcement must approve every technical detail of the test in advance

D. Because it is a legal requirement for every single engagement without exception

A. Contingency planning should include a defined incident/escalation procedure, clear roles for rapid response, and, where relevant, technical rollback or recovery steps, agreed and understood before testing begins

B. No contingency planning is necessary, since disruption should never happen if testers are sufficiently skilled

C. Contingency planning should only be considered after a disruption has actually occurred once

D. Contingency planning is solely the client's IT department's responsibility, with no input from the Red Team

A. Always agree to whatever scope the client requests, regardless of whether it can realistically be delivered to a professional standard within the available budget

B. Transparently discuss what can realistically be achieved to a professional standard within the available budget, adjusting scope, timeline, or resourcing as needed, rather than silently compromising quality or safety to fit an unrealistic combination

C. Refuse any negotiation and insist on the provider's original proposal with no flexibility whatsoever

D. Always prioritise maximising profit margin over realistic, achievable scope, regardless of client expectations

A. Ignore the discovery entirely and continue with unrelated objectives

B. Avoid unnecessary further access to or review of the data, document the discovery at a proportionate level of detail (e.g., that a directory containing sensitive personal data was found, without extracting its full contents), and follow the agreed escalation process

C. Download and review the entire directory in detail, since access was technically achieved through an in- scope path

D. Immediately delete the directory to protect the client

A. Inconsistency between what is legally authorised and what the Rules of Engagement actually permits could create ambiguity about what activity is genuinely covered, increasing legal and operational risk

B. The Rules of Engagement always legally overrides the formal authorisation automatically

C. Only the Rules of Engagement has any legal relevance; the authorisation letter is symbolic

D. Consistency is not important, since they serve entirely unrelated purposes

A. The external Red Team provider

B. The regulator's inspection team

C. The small, informed internal group that manages and oversees the test on behalf of the entity

D. The IT helpdesk

A. Because STAR is legally required for every company regardless of sector

B. To obtain a genuinely rigorous, intelligence-led assessment of its resilience, proportionate to its risk profile, without being formally designated into the CBEST regime

C. To avoid ever having to think about cybersecurity again

D. To bypass all data protection obligations during testing

A. The Red Team should simply test the platform without seeking any additional consent

B. The client's own authorisation is automatically sufficient, since it is "their" data

C. The client generally cannot authorise testing of infrastructure it does not own or control; the vendor's own consent (and often a review of the vendor's specific testing policies) would typically be required before including their platform in technical scope

D. Third-party SaaS platforms should never be discussed during scoping at all

A. Each engagement must be planned against the specific scheme's actual governance, documentation, timing, and accreditation requirements, rather than assuming interchangeability across frameworks

B. Jurisdictional differences are purely cosmetic and can be ignored by an experienced manager

C. Only the Red Team's technical toolset needs to change between jurisdictions; governance can remain identical

D. It is safe to apply exactly the same generic process and documentation across every jurisdiction without adaptation