最新のCCRTM-MCLF問題集で試験を準備する

CREST CCRTM-MCLF 試験概要:

CREST CCRTM-MCLF 試験シラバストピック:

CREST Certified Red Team Manager - Multiple Choice Long Form 認定 CCRTM-MCLF 試験問題：

問題 #1

Which of the following best explains why access to the full, detailed Rules of Engagement document is typically restricted to a small, defined group within the client organisation?

A. Restricting access has no security rationale and is done purely out of habit
B. Restriction is required only because of copyright law protecting the document's contents
C. Because the RoE can reveal engagement timing, testing approach, and sensitive operational detail, restricting access to those with a genuine need to know (e.g., the Control Group) helps preserve the Blue Team's blindness and the exercise's overall realism and security
D. RoE documents are never restricted and should be shared with all staff to maximise transparency

問題 #2

Which of the following best describes appropriate practice regarding follow-up validation or retesting of previously identified critical findings after remediation has been implemented?

A. Retesting is solely the client's own internal team's responsibility, and external providers should never be involved
B. Retesting is never useful, since remediation should always be assumed to have been fully effective
C. Retesting or validation of remediation for critical findings provides valuable, evidence-based confirmation that the fix genuinely addresses the underlying issue, rather than relying solely on the client's own unverified assertion that it has been resolved
D. Retesting should always cover the entire original scope in full, regardless of what was actually remediated

問題 #3

Why is the Blue Team kept unaware of an in-progress TIBER-EU test for as long as operationally safe?

A. Because data protection law requires it
B. Because the Blue Team has no role in the framework at all
C. To obtain a genuine, unbiased measurement of detection and response capability, free from the behavioural bias that foreknowledge would introduce
D. To save money on communication

問題 #4

Which of the following best describes appropriate retention and eventual disposal of sensitive engagement data (logs, evidence, draft reports) held by the provider after the engagement has formally concluded?

A. All data should be deleted immediately upon report delivery, with absolutely no exceptions or retention period
B. Retention and disposal should follow an agreed, documented policy consistent with the contract and applicable data protection/record-keeping law, balancing legitimate retention needs (e.g., potential future reference, dispute resolution) against the risk of holding sensitive data longer than necessary
C. Retention and disposal decisions are entirely at each individual consultant's personal discretion, with no organisational policy
D. Sensitive data should be retained indefinitely by the provider, with no defined disposal process

問題 #5

Which of the following statements about "safe words" or coded phrases sometimes used in physical/social engineering engagements is most accurate?

A. Safe words have no legitimate use in professional engagements
B. Safe words replace the need for any written authorisation
C. A pre-agreed safe word or phrase can allow a tester, if directly challenged or in a difficult situation during physical/social engineering activity, to discreetly verify their authorised status to a designated client contact without fully breaking the test's cover inappropriately or escalating unnecessarily
D. Safe words are only relevant to technical (not physical) testing

解説：