Learn with CREST : CCRTM-MCLF training material for 100% pass

Which of the following best describes governance considerations relevant to how a firm decides the overall cadence (e.g., annual, every three years) of its intelligence-led testing programme, beyond any specific regulatory minimum?

• A. Cadence should be decided solely by the Red Team provider, with no client governance input
• B. Cadence should reflect the firm's own risk assessment, pace of technological and organisational change, and evolving threat landscape, potentially exceeding any regulatory minimum where the firm's own risk profile justifies more frequent testing
• C. Cadence should always be set to the absolute legal minimum permitted, with no further consideration
• D. Cadence is irrelevant, since a single test is always sufficient regardless of subsequent organisational change

Explanation: Only visible for Exam4Labs members. You can sign-up / login (it's free).

A client asks the Red Team Manager to scope a purely "assumed breach" style engagement (starting testers with a foothold already in place, rather than requiring external initial access) instead of a full external-to- internal simulation. Which is the most accurate assessment?

• A. This is never a legitimate scoping choice and should always be refused
• B. Assumed breach testing can never be combined with any threat intelligence input
• C. Assumed breach scoping automatically disqualifies the engagement from being called "intelligence-led"
• D. An "assumed breach" starting point is a legitimate and often valuable scoping choice, particularly where time or budget is limited and the client's priority is testing internal detection, response, and lateral movement resilience rather than re-demonstrating external initial access techniques that may already be well understood; the key professional requirement is that the rationale, objectives, and resulting limitations (for example, that it will not directly test perimeter/initial-access defences) are clearly understood and documented. It is not something to be refused outright as illegitimate (C); it can still be genuinely informed by real threat intelligence about how a plausible actor might behave once inside (contradicting both B and A) - the "intelligence-led" character comes from realistic scenario design, not solely from the starting point of access.
• E. This can be a legitimate, valuable scoping choice - for example, to focus limited time on testing lateral movement, detection, and internal response capability - provided the rationale, objectives, and any resulting limitations on what the exercise can and cannot demonstrate are clearly understood and documented

A Control Team Lead is deciding whether a deviation from the agreed SSD (an unplanned pivot to a system just outside scope) should be authorised mid-test. What is the correct governance approach under TIBER-EU?

• A. The test is automatically void the moment any deviation is proposed
• B. Deviations are never permitted under any circumstances, even with Control Team agreement
• C. The Red Team provider alone decides and proceeds without any documentation
• D. The deviation is documented, escalated to the Control Team for an explicit decision, and any authorised change is recorded, with the Test Manager kept informed for quality assurance purposes

Explanation: Only visible for Exam4Labs members. You can sign-up / login (it's free).

Which of the following best describes appropriate governance around procurement and provider selection for an intelligence-led testing engagement?

• A. Only providers personally known to the CEO should ever be considered
• B. Provider selection has no meaningful governance dimension and can be delegated entirely without oversight
• C. Provider selection should be a governed process considering factors such as relevant accreditation, demonstrated competence, appropriate staff vetting, references, and cultural/operational fit, alongside commercial terms
• D. Provider selection should be based solely on the lowest quoted price, with no other criteria

Explanation: Only visible for Exam4Labs members. You can sign-up / login (it's free).

A firm's Control Group is considering whether to notify law enforcement in advance of a CBEST engagement given planned social engineering elements involving front-of-house staff. What is the most appropriate consideration?

• A. Only the Red Team provider's marketing department needs to be informed
• B. Advance, discreet notification (or having verifiable authorisation readily available) can be prudent so that if physical/social engineering activity triggers a genuine security response, it can be quickly de- escalated and correctly attributed to authorised testing
• C. Notifying law enforcement automatically cancels the engagement
• D. Law enforcement should never be informed of any security testing

Explanation: Only visible for Exam4Labs members. You can sign-up / login (it's free).