CCRTM-MCLF 試験問題を無料オンラインアクセス

Which of the following best describes an appropriate way to scope resourcing (team composition, skillsets, and time) against the agreed objectives?

• A.The minimum possible resourcing should always be used, regardless of objectives, to maximise profit margin
• B.Resourcing should be deliberately matched to the complexity, breadth, and depth implied by the agreed objectives and scope, ensuring the team has the right skills, sufficient time, and adequate capacity to realistically achieve what has been agreed
• C.Resourcing decisions are entirely the client's responsibility, with no input from the Red Team provider
• D.Resourcing should be decided arbitrarily, with no reference to the agreed objectives or scope

What is a key benefit to the Hong Kong banking sector of having a CREST-accredited pool of iCAST providers rather than allowing any vendor to deliver the service?

• A.It ensures only providers based physically in Hong Kong can ever be accredited
• B.Accreditation provides assurance of provider competence, methodology rigor, staff vetting, and operational security appropriate to the sensitivity of live testing on banking infrastructure
• C.It guarantees the lowest possible price for AIs
• D.It has no meaningful benefit and simply adds bureaucracy

A red team engagement spans multiple countries with differing computer misuse/cybercrime laws. What is the most professionally sound approach to managing this legal complexity?

• A.Assume the laws of the provider's home country apply everywhere the testing occurs
• B.Only consider the jurisdiction where the client's head office is located, regardless of where systems are actually hosted or accessed from
• C.Identify the specific legal requirements of each relevant jurisdiction, obtain appropriate local legal advice where needed, and ensure authorisation and Rules of Engagement properly address each jurisdiction's requirements
• D.Ignore jurisdictional differences entirely, since cybercrime law is assumed to be identical worldwide

Why is "deconfliction" with other concurrent security activities (e.g., a separate vulnerability scanning programme, or another vendor's assessment) an important RoE consideration?

• A.Deconfliction is only relevant to physical, not technical, engagements
• B.Deconfliction is unnecessary since concurrent activities never interact with each other
• C.Without deconfliction, overlapping activity could cause confusion (e.g., misattributing real vs simulated attack activity), duplicate effort, or unintended interference between different assessment activities
• D.Deconfliction is solely the client's responsibility, with no input needed from the Red Team

Which of the following best distinguishes "strategic," "operational," and "tactical" levels of threat intelligence?

• A.They are simply different names for the same type of intelligence product
• B.Strategic intelligence informs high-level, long-term risk and business decisions; operational intelligence informs planning of specific campaigns or activity; and tactical intelligence provides granular, technical detail (e.g., specific TTPs or indicators) used in immediate, hands-on activity
• C.Strategic intelligence is always more accurate than tactical intelligence
• D.Tactical intelligence is only relevant to physical security, never cyber threats