CREST CCRTM-SC 試験概要:

CREST CCRTM-SC 試験シラバストピック:

CREST Certified Red Team Manager - Scenario 認定 CCRTM-SC 試験問題：

問題 #1

Background: You lead the threat intelligence workstream for an intelligence-led engagement against Thornbury Energy Supply, a mid-sized UK energy retailer voluntarily commissioning STAR-FS-aligned testing. Two of your open-source intelligence sources - a well-regarded commercial threat intelligence feed (historically rated highly reliable) and a smaller, independent security researcher's blog (previously unrated by your team, but sometimes cited by others in the industry) - offer conflicting characterisations of the most plausible threat actor. The commercial feed assesses that Thornbury's sector is currently most targeted by a financially motivated group using commodity ransomware delivered via exposed RDP and unpatched VPN appliances. The independent blog, in a recent post, claims - citing an anonymous source it does not name - that a specific, more sophisticated actor group is "actively targeting UK mid-sized energy retailers specifically" using a novel technique involving compromised smart-metering data platforms, though no other source you can find corroborates this specific claim.
Your junior analyst is enthusiastic about the independent blog's claim, arguing "it's much more interesting and specific to energy, and the smart-metering angle would make for a really compelling, novel scenario for the client." Separately, the engagement's fixed timeline only allows for one primary scenario to be developed in the time available.
Question: Explain how you would assess and reconcile these conflicting sources, and justify which scenario direction you would ultimately recommend, addressing the analytical principles involved.

問題 #2

Background: You are scoping an engagement for Ashcombe Retail Bank, a mid-sized UK bank preparing for its first CBEST engagement. During the scoping workshop, the Head of Digital Channels strongly advocates for an objectives-based ("flag") approach, proposing a single objective: "achieve unauthorised funds transfer capability in the core payments system." The Head of Operational Resilience, in the same meeting, separately advocates for a crown-jewels (asset-based) approach explicitly listing seven named critical systems that must each be individually assessed, arguing the board specifically wants to see coverage confirmation against each one for their operational resilience self-assessment.
Both stakeholders are Control Group members, and neither is aware the other has a different underlying preference until this workshop, where the disagreement becomes evident in real time. The engagement's resourcing (agreed with the Bank of England as broadly appropriate for a first CBEST engagement of this bank's size) is not large enough to comfortably deliver a deep, patient, objectives-based campaign against one target AND a full individual assessment of all seven named systems within the available testing window.
Question: As the Red Team Manager facilitating this scoping workshop, how would you help the Control Group resolve this disagreement, and what would you recommend? Explain your reasoning.

解説：