Study with CCRTM-MCLF most valid questions & verified answers

A prospective client asks a Red Team Manager whether social engineering testing involving employee personal email accounts (not provided by the employer) can be included in scope. What is the most legally sound response?

• A. This raises significant legal and ethical complexity, since the client cannot straightforwardly authorise access to accounts and data it does not own or control, and such testing generally should not be included without separate, specific consideration (and likely exclusion)
• B. This is always fully permissible with no additional consideration required
• C. It is irrelevant, since all testing activity is automatically covered by the general engagement contract
• D. Personal email testing is always required for a valid engagement

A Red Team Manager is designing a proposal referencing "intelligence-led testing" for a prospective client outside the financial sector (e.g., a critical national infrastructure energy provider). Which statement about applicability is most accurate?

• A. Intelligence-led testing principles apply only to banks and can never be adapted to other critical sectors
• B. Only government departments may ever commission intelligence-led testing
• C. Energy providers are legally barred from any form of red team testing
• D. The underlying intelligence-led methodology (threat intelligence, scenario design, live testing, blind defenders, structured closure) can be adapted to other critical sectors, even where a bespoke named scheme like CBEST does not apply, provided governance and legal considerations are properly addressed for that context

Why is "deconfliction" with other concurrent security activities (e.g., a separate vulnerability scanning programme, or another vendor's assessment) an important RoE consideration?

• A. Deconfliction is solely the client's responsibility, with no input needed from the Red Team
• B. Deconfliction is only relevant to physical, not technical, engagements
• C. Without deconfliction, overlapping activity could cause confusion (e.g., misattributing real vs simulated attack activity), duplicate effort, or unintended interference between different assessment activities
• D. Deconfliction is unnecessary since concurrent activities never interact with each other

Why is early identification of stakeholders (e.g., business owners of in-scope systems, legal, data protection officer, IT operations leadership) considered essential during scoping?

• A. Ensuring relevant stakeholders are identified and engaged early helps secure genuine authority for scope decisions, surface constraints or risks the provider may not otherwise know about, and support smooth escalation during testing
• B. Stakeholder identification is unnecessary; the Red Team provider can proceed with technical planning alone
• C. Only the CEO needs to be identified; all other stakeholders are irrelevant
• D. Stakeholders are only relevant during the closure/reporting phase, never during scoping

Why might an authority decide NOT to grant attestation following a TIBER-EU test?

• A. Attestation depends solely on whether the Red Team successfully compromised every target
• B. Attestation is granted unconditionally regardless of how the test was conducted
• C. If the test significantly deviated from the agreed scope or framework requirements in ways that undermine confidence in its validity, the Test Manager may recommend against attestation
• D. Attestation is withheld only if the entity requests it be withheld