Which of the following best describes the governance implications of using an internal (in-house) red team resource rather than an external provider for certain testing activity, as permitted under some frameworks (e.
g., DORA, subject to conditions)?

• A. Internal resource use removes the need for any Rules of Engagement or authorisation
• B. Internal resources always require identical governance to external providers with no additional considerations
• C. Using internal resources introduces specific governance considerations around genuine independence, avoiding conflicts of interest, and meeting any framework-specific conditions (e.g., competence, segregation from the teams being tested) that apply to internal testers
• D. Internal resources can never be used under any circumstances in any framework

Explanation: Only visible for ValidBraindumps members. You can sign-up / login (it's free).

Which of the following best describes an appropriate balance between using MITRE ATTandCK-mapped TTPs and allowing red team testers creative flexibility in execution?

• A. Creative flexibility should always override any consideration of realistic, evidence-based adversary behaviour
• B. Testers should follow ATTandCK-listed techniques exactly and mechanically, with zero deviation or creative judgement at any point
• C. ATTandCK has no relevance to how testers actually execute technical activity
• D. ATTandCK mapping should inform and ground the scenario in realistic, evidence-based adversary behaviour, while still allowing skilled testers appropriate professional judgement and creativity in exactly how techniques are practically executed against the specific target environment

Explanation: Only visible for ValidBraindumps members. You can sign-up / login (it's free).

Which of the following best describes why maintaining a clear distinction between "governance of the testing programme" and "governance of day-to-day IT security operations" is important?

• A. There is no meaningful distinction to maintain; they are the same governance function
• B. Keeping these distinct helps preserve the independence and objectivity of the testing programme's oversight, and avoids the conflicts of interest that could arise if the same people governed both the assessment and the thing being assessed
• C. This distinction is only relevant for engagements delivered under CBEST
• D. Day-to-day IT security operations should always govern the testing programme directly

Explanation: Only visible for ValidBraindumps members. You can sign-up / login (it's free).

Under the UK's Computer Misuse Act 1990, what is the primary defence available to a red team tester who accesses a computer system as part of an authorised engagement?

• A. That the tester is a CREST-certified professional, which grants blanket immunity regardless of authorisation
• B. That the client verbally agreed at some point in the past, regardless of documentation
• C. There is no defence available; all access is automatically an offence
• D. That the access was authorised by a person entitled to grant such authorisation, meaning it falls outside the definition of "unauthorised access"

Explanation: Only visible for ValidBraindumps members. You can sign-up / login (it's free).

Which of the following best captures the relationship between the RoE and insurance/indemnity provisions discussed elsewhere in this domain?

• A. Insurance automatically overrides and replaces the need for a Rules of Engagement document
• B. They are entirely unconnected; insurance never needs to be referenced in relation to the RoE
• C. The RoE is a purely insurance-industry document with no operational function
• D. The RoE's operational boundaries (what is permitted, prohibited, and how risk is managed) directly shape the actual risk profile that insurance and indemnity provisions are designed to cover, so the two should be consistent with one another

Explanation: Only visible for ValidBraindumps members. You can sign-up / login (it's free).