Which of the following best summarises the overall legal theme running through Rules of Engagement, written authorisation, data protection compliance, and insurance/indemnity provisions in red team engagements?

• A. Only written authorisation matters; the others are optional extras
• B. These elements are unrelated administrative burdens with no coherent shared purpose
• C. Together, they form a coherent risk management and legal protection framework that clarifies what is authorised, protects personal data and sensitive information, and allocates financial/legal risk appropriately between the parties
• D. These elements exist solely to benefit the client, with no protective value for the provider

Explanation: Only visible for ActualTestsIT members. You can sign-up / login (it's free).

Which of the following best describes the purpose of maintaining and periodically updating internal methodology and knowledge management resources within a red team practice?

• A. Knowledge management is solely the concern of very large, multinational providers, irrelevant to smaller practices
• B. Methodology documentation should never be updated once initially created, to preserve consistency
• C. Methodology documentation has no practical benefit and is rarely maintained in professional practice
• D. Well-maintained methodology and knowledge resources support consistent quality, help onboard and train staff effectively, and ensure the practice's approach evolves to reflect current threat intelligence, techniques, and lessons learned

Explanation: Only visible for ActualTestsIT members. You can sign-up / login (it's free).

Which best describes the intended relationship between a CBEST engagement and the firm's day-to-day incident response process?

• A. Incident response is suspended for the duration of CBEST testing
• B. CBEST replaces the need for a documented incident response plan
• C. CBEST is designed, where the Blue Team is blind, to genuinely exercise the real incident response process as it would function against an actual attack
• D. CBEST exists entirely separately and should never interact with real incident response processes

Explanation: Only visible for ActualTestsIT members. You can sign-up / login (it's free).

Which of the following statements about scope creep during an engagement is most accurate?

• A. Scope creep is impossible once a Rules of Engagement document has been signed
• B. Scope creep is always beneficial and should be actively encouraged with no controls
• C. Scope creep only matters if it results in additional cost to the client
• D. Scope creep - informal, undocumented expansion of activity beyond what was originally agreed - should be actively managed through a defined change control process, since unmanaged expansion increases legal, operational, and resourcing risk

Explanation: Only visible for ActualTestsIT members. You can sign-up / login (it's free).

Which of the following best describes the purpose of a formal scope sign-off (approval) gate before testing begins?

• A. It provides a clear, documented point at which accountable stakeholders formally confirm they understand and approve the agreed scope, objectives, and constraints, before any live testing activity starts
• B. It is only relevant for engagements under CBEST, never for other types of engagement
• C. It replaces the need for the formal legal authorisation document
• D. It has no real function beyond bureaucratic delay

Explanation: Only visible for ActualTestsIT members. You can sign-up / login (it's free).