Which of the following best describes why a Red Team Manager should ensure clear internal documentation of decisions made and their rationale throughout an engagement's delivery, separate from client-facing reporting?

• A. Internal documentation of decisions and rationale supports internal quality assurance, provides continuity if personnel change, and creates a valuable internal record for future learning and, if ever needed, for demonstrating the professional basis for decisions made
• B. Internal documentation is only useful for very large, multinational providers
• C. Internal documentation should be actively avoided, to reduce the risk of it being discoverable in future disputes
• D. Internal documentation serves no purpose beyond client-facing reporting

Explanation: Only visible for PassLeaderVCE members. You can sign-up / login (it's free).

Which of the following best describes the concept of a "three lines of defence" model as it might apply to governance of a red team programme within a large organisation?

• A. It refers to a governance model distinguishing operational management (first line), risk/compliance oversight functions (second line), and independent assurance such as internal audit (third line), each playing a distinct role in overseeing the programme's effectiveness
• B. It has no relevance to red team governance whatsoever
• C. It refers to three separate Red Team providers being used simultaneously
• D. It refers exclusively to the three phases of testing (scoping, testing, closure)

Explanation: Only visible for PassLeaderVCE members. You can sign-up / login (it's free).

Which of the following best describes the sequence of phases in a standard CBEST engagement?

• A. Testing, Scoping, Threat Intelligence, Closure
• B. Threat Intelligence, Closure, Scoping, Testing
• C. Scoping, Threat Intelligence, Testing (Red Team), Closure
• D. Closure, Scoping, Testing, Threat Intelligence

Explanation: Only visible for PassLeaderVCE members. You can sign-up / login (it's free).

Following an iCAST engagement, what is an AI generally expected to do with identified weaknesses?

• A. Immediately terminate all IT staff involved
• B. Publicly announce the vulnerabilities to demonstrate transparency
• C. Develop and track a remediation plan addressing identified weaknesses, often subject to supervisory follow-up
• D. Nothing further is required once the report is delivered

Explanation: Only visible for PassLeaderVCE members. You can sign-up / login (it's free).

Which of the following best describes an appropriate approach when a Red Team Manager identifies, partway through resourcing an engagement, that the team as currently assembled lacks a specific skill genuinely required to achieve an agreed objective?

• A. Proactively address the gap - for example, by bringing in additional or different expertise, adjusting the plan, or transparently discussing the limitation and its implications with the client - rather than silently proceeding with an inadequately skilled team
• B. Cancel the entire engagement immediately with no attempt to resolve the resourcing gap
• C. Assign the task to whichever team member is most available, regardless of relevant skill
• D. Proceed regardless and simply omit that objective from the final report with no explanation

Explanation: Only visible for PassLeaderVCE members. You can sign-up / login (it's free).