CREST Certified Red Team Manager - Multiple Choice Long Form - CCRTM-MCLF Exam Practice Test

A. Cost has no bearing on whether an engagement can be labelled CBEST

B. Any CREST member automatically qualifies regardless of specific CBEST accreditation

C. This is acceptable, as CBEST is not a controlled or accredited scheme

D. Only engagements delivered by providers accredited under the scheme's defined criteria, following the Implementation Guide's process, can be recognised as CBEST; an unaccredited "CBEST-style" test is not equivalent and will not carry the same regulatory recognition

A. Internal Cyber Assurance and Systems Testing

B. International Compliance Assessment and Security Tracking

C. Intelligence-led Cyber Attack Simulation Testing

D. Independent Cybersecurity Audit and Standards Testing

A. Legacy systems are irrelevant to scoping discussions since they are rarely internet-facing

B. The specific risk these systems present should be discussed with relevant stakeholders, and a proportionate approach agreed - which might include careful, limited testing, exclusion, or testing in a closely supervised manner with enhanced contingency planning

C. Legacy systems should always be included with no additional precaution, since they are often the most realistic targets

D. Legacy systems should always be excluded automatically without any risk-based discussion

A. To publicly shame the Blue Team for missed detections

B. To negotiate the Red Team provider's final invoice

C. To repeat the entire 12-week Red Team phase

D. To collaboratively walk through the attack timeline so the Blue Team understands what happened and both teams can identify concrete detection and response improvements

A. Only CBEST matters; the others are irrelevant regional curiosities

B. Rigorous, well-governed, intelligence-led testing is a globally recognised and increasingly expected discipline for protecting critical financial (and other critical) infrastructure, and delivering it responsibly requires scheme-specific, jurisdiction-aware governance rather than a one-size-fits-all approach

C. Frameworks exist purely to generate revenue for accreditation bodies

D. All frameworks are functionally optional and can be disregarded if inconvenient

A. Detailed record-keeping is legally required only in the United States

B. Records should be deleted immediately after each testing day to reduce data protection risk

C. Records serve no legal purpose and exist only for internal team reference

D. Detailed records provide an auditable trail demonstrating that activity stayed within authorised scope, support correlation with the client's own logs during closure, and could be important evidence if the legality or conduct of the engagement were ever questioned

A. Only the Rules of Engagement has any legal relevance; the authorisation letter is symbolic

B. The Rules of Engagement always legally overrides the formal authorisation automatically

C. Inconsistency between what is legally authorised and what the Rules of Engagement actually permits could create ambiguity about what activity is genuinely covered, increasing legal and operational risk

D. Consistency is not important, since they serve entirely unrelated purposes

A. Testing - Threat Intelligence

B. Preparation

C. Closure

D. There is no purple teaming element in TIBER-EU

A. In the event of an urgent issue (e.g., accidental disruption, discovery of a genuine incident) outside normal working hours or requiring rapid senior decision-making, having pre-identified emergency contacts and a clear escalation path enables a fast, appropriate response

B. Emergency contacts are only relevant for physical, not technical, engagements

C. Escalation paths should always route directly to the media relations team first

D. Emergency contacts are unnecessary if a Rules of Engagement document already exists