最新のCCRTM-MCLF問題集で試験を準備する

CREST CCRTM-MCLF 試験概要:

CREST CCRTM-MCLF 試験シラバストピック:

CREST Certified Red Team Manager - Multiple Choice Long Form 認定 CCRTM-MCLF 試験問題：

問題 #1

What document formally defines the scope of a TIBER-EU test, including the Critical or Important Functions to be assessed?

A. The Blue Team Report
B. The Red Team Test Report
C. The Attestation Letter
D. The Scope Specification Document (SSD)

問題 #2

Which of the following best describes appropriate practice regarding secure delivery of the final report and supporting evidence to the client?

A. Reports and sensitive supporting evidence should be delivered via secure, appropriately access- controlled and, where relevant, encrypted mechanisms, consistent with the sensitivity of the material and any agreed contractual requirements
B. Reports should always be printed and posted physically, never delivered electronically
C. Secure delivery mechanisms are unnecessary, since the report is intended for the client anyway
D. Reports should be sent via standard, unencrypted email with no additional protection, for convenience

問題 #3

Which of the following best reflects how the RoE should treat the use of testers' personal (non-client-issued, non-provider-issued) devices or accounts during an engagement?

A. The RoE should typically require the use of approved, provider-managed and appropriately secured infrastructure and accounts, avoiding personal devices or accounts, to maintain security, accountability, and clear evidential/audit boundaries
B. Personal devices and accounts should always be used, since this best simulates real attacker behaviour
C. Personal device use is irrelevant to Rules of Engagement and does not need to be addressed
D. The client's own IT policy on personal devices is entirely irrelevant to the engagement

問題 #4

What internal role in TIBER-EU was historically referred to as the "White Team" and has more recently been reframed as the "Control Team" in updated ECB guidance?

A. The IT helpdesk
B. The small, informed internal group that manages and oversees the test on behalf of the entity
C. The regulator's inspection team
D. The external Red Team provider

問題 #5

Which of the following best describes why threat intelligence used for scenario design should ideally be current, not stale?

A. Threat actor behaviour, tooling, and the broader threat landscape evolve over time, so relying on outdated intelligence risks building a scenario around threats or techniques that are no longer genuinely representative of the current, plausible risk
B. Currency has no bearing on the relevance of a scenario
C. Older intelligence is always more reliable than recently gathered intelligence
D. Currency only matters for financial market intelligence, never cyber threat intelligence

解説：