CREST Certified Red Team Manager - Multiple Choice Long Form - CCRTM-MCLF Exam Practice Test

A. To provide realistic, evidence-based insight into how the AI's people, processes and technology would withstand a plausible, targeted cyberattack

B. To replace the need for any Inherent Risk Assessment

C. To certify the AI's core banking software vendor

D. To satisfy a purely administrative box-ticking exercise with no bearing on real security

A. After testing has already begun, once the team has a better sense of what rules might be needed

B. RoE only needs to be finalised at the very end of the engagement, as a summary document

C. Before any live technical testing activity begins, as part of the formal authorisation and governance process

D. RoE sign-off is optional and can be skipped if the client is a repeat customer

A. This is fully permitted, as duration is entirely at the entity's discretion

B. Shortening the window has no effect on realism or outcomes

C. The 12-week figure applies only to Preparation, not Red Team testing

D. This would deviate from TIBER-EU's recommended minimum designed to allow realistic, patient adversary emulation, and any such change should be discussed with the Test Manager and relevant authority rather than decided unilaterally

A. Internal documentation should be actively avoided, to reduce the risk of it being discoverable in future disputes

B. Internal documentation is only useful for very large, multinational providers

C. Internal documentation serves no purpose beyond client-facing reporting

D. Internal documentation of decisions and rationale supports internal quality assurance, provides continuity if personnel change, and creates a valuable internal record for future learning and, if ever needed, for demonstrating the professional basis for decisions made

A. The Red Team should simply test the platform without seeking any additional consent

B. Third-party SaaS platforms should never be discussed during scoping at all

C. The client generally cannot authorise testing of infrastructure it does not own or control; the vendor's own consent (and often a review of the vendor's specific testing policies) would typically be required before including their platform in technical scope

D. The client's own authorisation is automatically sufficient, since it is "their" data

A. Accreditation, once obtained, never needs to be renewed or maintained

B. Accreditation is solely a marketing tool with no connection to actual technical competence

C. Maintained, relevant individual accreditation provides an externally validated benchmark of an individual's current competence, supporting both service quality and the credibility/assurance the provider organisation can offer clients

D. Individual accreditation has no bearing on service quality or client assurance

A. Testers should pause the specific activity in question where safely possible and escalate promptly through the agreed communication/escalation path for a timely decision, given the situation falls outside pre-agreed boundaries

B. The entire engagement must be permanently cancelled the moment any unanticipated situation arises

C. Testers should simply proceed as if the situation were explicitly covered by the closest analogous rule, with no escalation

D. Testers should use their own unilateral judgement to decide the best course of action with no escalation, to avoid delay

A. It is used exclusively to model the financial cost of an intrusion

B. It replaces the need for the Cyber Kill Chain entirely

C. It has no practical application to red team scenario design

D. It provides a structured way to analyse an intrusion event in terms of the relationships between an adversary, their capability, the infrastructure they use, and the victim, supporting more systematic understanding of threat activity

A. Attestation is a legal finding of criminal liability against the entity

B. Attestation is granted automatically the moment a contract with a provider is signed

C. Attestation confirms that the test was conducted in accordance with the TIBER-EU framework and agreed scope, based on the Test Manager's assessment and the authority's review

D. Attestation guarantees the entity will never suffer a future breach

A. Threat intelligence has no relevance once active testing has concluded

B. Closure-phase discussions should deliberately avoid referencing the original threat intelligence rationale

C. The original threat intelligence assessment provides valuable context during closure, helping the Blue Team and Control Team understand not just what happened technically, but why that particular scenario was genuinely plausible and relevant to the organisation

D. Threat intelligence analysts have no role in the closure phase under any circumstances

A. Insurance coverage should be periodically reviewed and adjusted to remain appropriate to the practice's actual, current risk exposure as its client base, engagement complexity, and potential liability grow

B. Insurance coverage is entirely irrelevant to management decision-making

C. Insurance coverage, once set, never needs to be reviewed regardless of how the business or its engagements change over time

D. Insurance requirements are identical for every red team practice regardless of size or client profile

A. Works councils only have authority over pension arrangements

B. These requirements have no bearing on cybersecurity testing anywhere

C. Employment law only applies to permanent, full-time staff, never contractors

D. In some jurisdictions, employee monitoring, testing, or profiling activity may engage employment law and works council consultation obligations, which should be considered and addressed as part of legally sound scoping and authorisation

A. Operational Resilience rules replace the need for CBEST entirely

B. CBEST is one practical mechanism firms can use to test and evidence their resilience against cyberattack, complementing the broader operational resilience obligations around Important Business Services and impact tolerances

C. They are entirely separate and unrelated regimes

D. CBEST determines a firm's statutory impact tolerances

A. Incorporate the plausible scenario into the AI's own test where feasible, and separately ensure the broader vendor risk is captured in the AI's third-party/vendor risk management process

B. Assume the vendor issue is not their concern and disregard it entirely

C. Publicly name the vendor to warn the market immediately

D. Refuse to proceed with iCAST at all

A. An external journalist covering financial technology

B. A junior helpdesk analyst with no risk ownership

C. A random sample of all IT staff to maximise transparency

D. A senior, accountable stakeholder such as the CISO or Head of Operational Resilience with authority to make risk decisions