최신CREST Certified Red Team Manager - Multiple Choice Long Form - CCRTM-MCLF무료샘플문제

A. It provides a structured way to analyse an intrusion event in terms of the relationships between an adversary, their capability, the infrastructure they use, and the victim, supporting more systematic understanding of threat activity

B. It has no practical application to red team scenario design

C. It replaces the need for the Cyber Kill Chain entirely

D. It is used exclusively to model the financial cost of an intrusion

A. It is not important; expertise in one framework is always sufficient for every client and jurisdiction

B. Client organisations increasingly operate across borders, and understanding the broader family of frameworks enables the manager to advise accurately on cross-jurisdictional obligations, avoid misapplying one scheme's requirements to another, and support informed, compliant programme design

C. Understanding other frameworks is purely of academic interest with no commercial relevance

D. All frameworks are legally interchangeable so no additional understanding is needed

A. Refuse any negotiation and insist on the provider's original proposal with no flexibility whatsoever

B. Transparently discuss what can realistically be achieved to a professional standard within the available budget, adjusting scope, timeline, or resourcing as needed, rather than silently compromising quality or safety to fit an unrealistic combination

C. Always agree to whatever scope the client requests, regardless of whether it can realistically be delivered to a professional standard within the available budget

D. Always prioritise maximising profit margin over realistic, achievable scope, regardless of client expectations

A. Nothing; communication should be entirely improvised as needed

B. Communication should only occur once, at the very end of the engagement

C. Agreed communication channels, frequency of status updates, and the specific escalation path (including emergency contacts) to be used if urgent issues arise

D. Only the Red Team's internal communication, with no client-facing communication defined

A. Internal audit may appropriately review the programme's governance, process adherence, and remediation tracking as part of its independent assurance role, without necessarily needing to be involved in the sensitive operational detail of live testing itself

B. Internal audit has no legitimate interest in this programme

C. Internal audit should directly manage and execute the Red Team testing activity itself

D. Internal audit's involvement automatically invalidates the requirement for a Control Group

A. Incident response planning is solely the concern of the provider's individual clients, never the provider itself

B. A red team provider should maintain its own robust incident response plan, since compromise of its own infrastructure could expose sensitive client data, tooling, or ongoing engagement information across multiple clients, creating a significant, cascading risk

C. Providers do not need their own incident response plan, since they only ever attack other organisations' systems

D. A provider's own incident response plan is only relevant if it has previously experienced an actual breach

A. Stakeholders are only relevant during the closure/reporting phase, never during scoping

B. Only the CEO needs to be identified; all other stakeholders are irrelevant

C. Ensuring relevant stakeholders are identified and engaged early helps secure genuine authority for scope decisions, surface constraints or risks the provider may not otherwise know about, and support smooth escalation during testing

D. Stakeholder identification is unnecessary; the Red Team provider can proceed with technical planning alone

A. No; discovering evidence of a genuine pre-existing compromise during testing does not remove the client's own separate legal/regulatory obligations (e.g., relevant breach notification requirements), which the client must assess and act on appropriately, informed by legal advice

B. Such discoveries can simply be omitted from the final report to avoid triggering obligations

C. The Red Team provider automatically assumes all regulatory reporting responsibility on the client's behalf

D. Yes, engaging a provider automatically discharges all regulatory reporting obligations

A. Export control has no relevance whatsoever to cybersecurity tools

B. Export control considerations were entirely abolished in 2015

C. Export control only applies to physical weapons, never software

D. Certain categories of intrusion software and related technology may be subject to export control restrictions, which organisations transferring or using such tools across borders need to be aware of and comply with

A. Internal QA review helps ensure findings are accurate, well-substantiated, clearly communicated, and consistent with agreed scope and professional standards before reaching the client, protecting both report quality and the provider's professional credibility

B. Internal QA review has no bearing on report quality or client trust

C. Internal QA review should only occur if specifically requested by the client

D. Internal QA review exists solely to inflate the reported number of findings

A. GDPR

B. MiFID II

C. The Payment Services Directive (PSD2)

D. The Digital Operational Resilience Act (DORA)

A. Immediately terminate the CBEST engagement

B. Ignore the third party, as CBEST only ever tests the firm's own infrastructure

C. Redirect the entire budget to replacing the third-party processor

D. The Control Group should assess whether the third-party dependency should be reflected in the scenario and, if direct testing of the third party is not possible, ensure the risk is documented and addressed through supply-chain governance

A. Scope creep is always beneficial and should be actively encouraged with no controls

B. Scope creep - informal, undocumented expansion of activity beyond what was originally agreed - should be actively managed through a defined change control process, since unmanaged expansion increases legal, operational, and resourcing risk

C. Scope creep is impossible once a Rules of Engagement document has been signed

D. Scope creep only matters if it results in additional cost to the client

A. Explicitly defining prohibited actions clarifies the boundaries of what has genuinely been authorised, reducing the risk that an action falls outside authorisation (with associated legal exposure) and reducing the risk of unintended harm

B. Prohibited actions are relevant only to junior testers, not senior consultants

C. Prohibited actions exist only to slow down the Red Team unnecessarily

D. Prohibited actions are unnecessary since testers should simply use good judgement with no written guidance

A. Correlation allows precise identification of what was and was not detected, and when, providing concrete, evidence-based insight into genuine detection and response capability gaps

B. Correlation serves no useful purpose once testing has concluded

C. Correlation should be avoided, since it might reveal uncomfortable gaps in detection capability

D. Correlation is only relevant if the Blue Team was aware of the test from the beginning