Which of the following best describes when the Rules of Engagement should be finalised and signed off relative to the start of technical testing?

• A. After testing has already begun, once the team has a better sense of what rules might be needed
• B. Before any live technical testing activity begins, as part of the formal authorisation and governance process
• C. RoE only needs to be finalised at the very end of the engagement, as a summary document
• D. RoE sign-off is optional and can be skipped if the client is a repeat customer

Which of the following best describes why a Red Team Manager should maintain a documented succession or continuity plan for key roles (e.g., Test Director) on long-running or particularly critical engagements?

• A. Succession planning should only be considered after a key individual has already become unavailable
• B. Succession planning is solely a human resources concern with no bearing on engagement delivery
• C. A documented continuity plan reduces the risk of significant disruption to the engagement's governance, quality, or continuity if a key individual becomes unexpectedly unavailable
• D. Succession planning is unnecessary, since key individuals are assumed to always be available throughout any engagement

Overall, what is the central strategic objective TIBER-EU is designed to achieve for the EU financial sector?

• A. To replace all internal cybersecurity teams with external consultants
• B. To catalogue every software vulnerability across the sector
• C. To provide a harmonised, intelligence-led means of testing and improving the cyber resilience of critical financial entities, supporting broader financial stability across the EU
• D. To generate revenue for the European Central Bank

Which of the following best describes the sequence of phases in a standard CBEST engagement?

• A. Scoping, Threat Intelligence, Testing (Red Team), Closure
• B. Testing, Scoping, Threat Intelligence, Closure
• C. Threat Intelligence, Closure, Scoping, Testing
• D. Closure, Scoping, Testing, Threat Intelligence

What is the role of the national "TIBER Cyber Team" (TCT)?

• A. It is an internal department of the tested entity
• B. It is the national (or, in some cases, ECB-level) authority function responsible for overseeing consistent, quality implementation of TIBER-EU within its jurisdiction
• C. It is the external Red Team provider hired to attack the entity
• D. It has no interaction with Test Managers