CREST CCRTM-MCLF 試験概要:

CREST CCRTM-MCLF 試験シラバストピック:

CREST Certified Red Team Manager - Multiple Choice Long Form 認定 CCRTM-MCLF 試験問題：

問題 #1

Which of the following best describes the legal significance of a well-defined "chain of custody" process for evidence gathered during a red team engagement?

A. Chain of custody is only relevant to criminal police investigations, never to red team engagements
B. A clear chain of custody helps demonstrate the integrity and provenance of evidence, which can be important if findings are later relied upon in a legal, regulatory, or disciplinary context
C. Chain of custody has no legal significance in this context
D. Chain of custody exists purely to satisfy internal quality assurance, with no external relevance

問題 #2

An AI's Control Group discovers mid-engagement that the iCAST Red Team's actions are about to affect a shared, multi-tenant data centre environment used by other unrelated institutions. What is the most appropriate response?

A. Cancel the AI's banking licence
B. Pause and escalate, ensuring any action affecting shared, multi-tenant infrastructure is properly authorised (including consent from the data centre operator and consideration of impact on other tenants) before continuing
C. Immediately inform the other tenants' customers directly
D. Proceed without pausing, since the AI authorised its own test

問題 #3

Which of the following best describes the purpose of a liability/indemnity clause in a red team engagement contract?

A. To guarantee the provider will never make a mistake
B. To transfer all criminal liability from the provider's staff to the client automatically
C. To eliminate all legal risk for both parties entirely
D. To allocate responsibility and financial risk between the provider and client for defined categories of loss or damage that might arise from the engagement, within agreed limits

問題 #4

Which of the following best describes the purpose of maintaining and periodically updating internal methodology and knowledge management resources within a red team practice?

A. Methodology documentation has no practical benefit and is rarely maintained in professional practice
B. Knowledge management is solely the concern of very large, multinational providers, irrelevant to smaller practices
C. Well-maintained methodology and knowledge resources support consistent quality, help onboard and train staff effectively, and ensure the practice's approach evolves to reflect current threat intelligence, techniques, and lessons learned
D. Methodology documentation should never be updated once initially created, to preserve consistency

問題 #5

Why is "deconfliction" with other concurrent security activities (e.g., a separate vulnerability scanning programme, or another vendor's assessment) an important RoE consideration?

A. Without deconfliction, overlapping activity could cause confusion (e.g., misattributing real vs simulated attack activity), duplicate effort, or unintended interference between different assessment activities
B. Deconfliction is solely the client's responsibility, with no input needed from the Red Team
C. Deconfliction is only relevant to physical, not technical, engagements
D. Deconfliction is unnecessary since concurrent activities never interact with each other

解説：