CREST Certified Red Team Manager - Multiple Choice Long Form - CCRTM-MCLF무료 덤프문제 풀어보기

A. CBEST automatically ceases to apply once a group has any EU presence

B. DORA TLPT applies specifically to the EU-domiciled, in-scope entities based on EU regulatory designation, and is distinct from the UK's CBEST regime, which applies separately to the UK entity under Bank of England/PRA/FCA supervision

C. DORA has no application to any entity with any UK operations whatsoever

D. Satisfying CBEST in the UK automatically satisfies DORA TLPT obligations for the EU entities with no further action

A. iCAST findings and the AI's remediation progress can reasonably inform the HKMA's ongoing supervisory view of the AI's cyber resilience and risk management effectiveness

B. iCAST outcomes have no bearing whatsoever on ongoing supervisory dialogue

C. iCAST results are used only to set the AI's account fees

D. A single iCAST result permanently fixes the AI's risk rating with no possibility of future reassessment

A. Treat DoS exclusion as making the entire engagement pointless and therefore not worth conducting

B. Refuse to proceed with the engagement at all, since DoS exclusion is unacceptable

C. Ignore the client's request and use DoS techniques anyway, since they may be realistic

D. Document the exclusion clearly in the Rules of Engagement and scope, and plan the engagement (including any contingency planning) around techniques that will not intentionally cause denial of service, while still pursuing realistic objectives within that constraint

A. The Red Team should always assume any suspicious activity found is part of their own simulated scenario

B. This scenario is so rare it does not need to be addressed during scoping

C. This scenario should only be addressed after it has already happened

D. Because it is a realistic possibility with significant legal, operational, and reputational implications, having an agreed escalation process defined in advance ensures a swift, appropriate response rather than confusion or delay if it occurs

A. Specificity is only relevant to the Threat Intelligence Report, never to how the Red Team actually executes the scenario

B. A plausible, tailored scenario ensures the exercise produces credible, relevant insight into how the organisation would actually fare against threats it genuinely faces, rather than testing against an unrealistic or irrelevant threat model

C. Generic scenarios are always more technically challenging and therefore more valuable

D. Plausibility and specificity have no bearing on the value of the resulting exercise

A. Every single financial entity in the EU, regardless of size, must perform TLPT

B. TLPT applicability is decided solely by the entity itself, with no external designation

C. Only entities headquartered in Frankfurt are in scope

D. Applicability is based on criteria such as systemic importance and risk profile, with competent authorities designating which entities fall in scope

A. Test environments rarely exist in financial institutions

B. Regulators are indifferent to environment choice

C. Only live production environments accurately reflect the real configuration, data flows, and defensive posture that a genuine attacker would encounter

D. Production environments are cheaper to test

A. Appropriate, proportionate staff vetting (such as background checks aligned to relevant standards) is an important risk management and, in many client contracts, a contractual obligation, given the high level of trust and access involved in this work

B. Vetting is only relevant for staff who will physically enter client premises

C. Vetting is unnecessary, since a signed NDA alone provides sufficient assurance

D. Vetting requirements are identical in every jurisdiction with no variation