Study with CCRTM-MCLF Actual Test Questions

Which of the following is the most appropriate rationale for excluding certain highly sensitive or life-critical systems from live technical testing, even where the client would otherwise like them included?

• A. Exclusion should never occur regardless of risk, since comprehensive testing is always more important than any other consideration
• B. Only cost, never risk, should ever influence exclusion decisions
• C. Where the potential risk of live testing (e.g., to safety, to a life-critical process, or of severe, hard-to- reverse impact) genuinely outweighs the realistic assurance benefit obtainable through live testing, professional judgement should favour exclusion or a safer alternative approach
• D. Exclusion decisions should be made unilaterally by the Red Team with no client or stakeholder involvement

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

During scoping, the client reveals that a critical system is managed by an entirely separate internal team that was not initially consulted. What is the most appropriate next step?

• A. Proceed with scoping as originally planned, since the client's initial input is sufficient
• B. Engage the relevant internal team managing that system to confirm their awareness, input, and any necessary sign-off before finalising scope that includes that system
• C. Assume the original client contact has full authority over every system in the organisation
• D. Automatically exclude the system permanently, with no further discussion

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Which of the following best reflects good practice regarding review and periodic revalidation of scope during a lengthy, multi-month engagement (such as a TIBER-EU-style 12-week+ Red Team phase)?

• A. Any change to the environment automatically and informally updates the agreed scope with no documentation needed
• B. Scope, once agreed, should never be revisited under any circumstances for the entire engagement
• C. Scope revalidation is solely the Red Team's responsibility, with no client involvement required
• D. Given that organisational environments can change meaningfully over a lengthy engagement, periodically revisiting and, where necessary, formally updating scope through the agreed change control process helps ensure it remains accurate and relevant

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Which best describes the intended relationship between a CBEST engagement and the firm's day-to-day incident response process?

• A. CBEST exists entirely separately and should never interact with real incident response processes
• B. CBEST replaces the need for a documented incident response plan
• C. CBEST is designed, where the Blue Team is blind, to genuinely exercise the real incident response process as it would function against an actual attack
• D. Incident response is suspended for the duration of CBEST testing

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Which of the following is the most appropriate handling approach for evidence (e.g., screenshots, extracted data samples) gathered to demonstrate successful exploitation during a red team engagement?

• A. Extract and retain as much raw sensitive data as possible, without limitation, "just in case it's useful later"
• B. Post interesting findings to a public technical blog immediately for professional recognition
• C. Store all evidence indefinitely on personal, unencrypted devices
• D. Apply data minimisation and proportionality - capture only what is genuinely necessary to demonstrate the finding, handle it securely, and dispose of it in line with the agreed contract terms and applicable data protection law

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).