CREST CCRTM-MCLF Actual Tests : CREST Certified Red Team Manager - Multiple Choice Long Form

Which of the following best describes the concept of a "three lines of defence" model as it might apply to governance of a red team programme within a large organisation?

• A. It refers exclusively to the three phases of testing (scoping, testing, closure)
• B. It has no relevance to red team governance whatsoever
• C. It refers to three separate Red Team providers being used simultaneously
• D. It refers to a governance model distinguishing operational management (first line), risk/compliance oversight functions (second line), and independent assurance such as internal audit (third line), each playing a distinct role in overseeing the programme's effectiveness

Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).

Which of the following best describes the legal significance of exceeding the agreed scope during a red team engagement, even with good intentions?

• A. Scope is merely a guideline with no binding effect
• B. Only the client can ever be held responsible for scope excursions, never the tester
• C. It has no legal significance as long as the tester believed it was helpful
• D. Action taken outside the authorised scope may not be covered by the client's authorisation, potentially exposing the tester (and provider) to liability under laws such as the Computer Misuse Act, regardless of good intent

Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).

Which of the following best describes the appropriate final step that formally concludes a well-governed intelligence-led testing engagement?

• A. Formal closure occurs automatically at a fixed calendar date with no reference to actual deliverable completion
• B. The engagement is considered concluded the moment the final invoice is paid, regardless of any other outstanding activity
• C. Formal closure typically involves agreement between the Control Group and provider (and, where relevant, the overseeing authority via attestation) that reporting, debrief, and remediation planning have been appropriately completed, with the engagement then formally recorded as closed
• D. There is no defined concept of formal closure; engagements simply end when the team stops working

Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).

Which of the following best describes appropriate governance around procurement and provider selection for an intelligence-led testing engagement?

• A. Only providers personally known to the CEO should ever be considered
• B. Provider selection should be a governed process considering factors such as relevant accreditation, demonstrated competence, appropriate staff vetting, references, and cultural/operational fit, alongside commercial terms
• C. Provider selection should be based solely on the lowest quoted price, with no other criteria
• D. Provider selection has no meaningful governance dimension and can be delegated entirely without oversight

Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).

Which of the following best describes the management rationale for ensuring individual consultants maintain relevant professional accreditation (e.g., CREST individual certifications) throughout their careers?

• A. Maintained, relevant individual accreditation provides an externally validated benchmark of an individual's current competence, supporting both service quality and the credibility/assurance the provider organisation can offer clients
• B. Individual accreditation has no bearing on service quality or client assurance
• C. Accreditation is solely a marketing tool with no connection to actual technical competence
• D. Accreditation, once obtained, never needs to be renewed or maintained

Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).