Which of the following best describes appropriate retention and eventual disposal of sensitive engagement data (logs, evidence, draft reports) held by the provider after the engagement has formally concluded?

• A. Retention and disposal decisions are entirely at each individual consultant's personal discretion, with no organisational policy
• B. Retention and disposal should follow an agreed, documented policy consistent with the contract and applicable data protection/record-keeping law, balancing legitimate retention needs (e.g., potential future reference, dispute resolution) against the risk of holding sensitive data longer than necessary
• C. All data should be deleted immediately upon report delivery, with absolutely no exceptions or retention period
• D. Sensitive data should be retained indefinitely by the provider, with no defined disposal process

Explanation: Only visible for iPassleader members. You can sign-up / login (it's free).

Which of the following best describes appropriate management practice regarding realistic timeline-setting for intelligence-led engagements that must accommodate minimum durations set by a framework (e.g., TIBER- EU's 12-week minimum active testing)?

• A. Timelines should always be set as short as technically possible, regardless of any framework guidance
• B. Framework-mandated minimum durations should be treated as a rough suggestion that can be freely shortened for management convenience
• C. Framework minimum durations are irrelevant to internal project planning, since they are only a legal formality
• D. Timelines should be planned to genuinely accommodate framework-mandated minimums, with realistic buffer for contingencies, rather than being compressed in ways that would undermine both compliance and the quality/realism of the engagement

Explanation: Only visible for iPassleader members. You can sign-up / login (it's free).

Which of the following should the Rules of Engagement explicitly define regarding communication during the engagement?

• A. Nothing; communication should be entirely improvised as needed
• B. Only the Red Team's internal communication, with no client-facing communication defined
• C. Agreed communication channels, frequency of status updates, and the specific escalation path (including emergency contacts) to be used if urgent issues arise
• D. Communication should only occur once, at the very end of the engagement

Explanation: Only visible for iPassleader members. You can sign-up / login (it's free).

Which of the following best describes appropriate management practice regarding a red team provider's own internal incident response plan, in the event the provider's own infrastructure or systems were compromised?

• A. Incident response planning is solely the concern of the provider's individual clients, never the provider itself
• B. A provider's own incident response plan is only relevant if it has previously experienced an actual breach
• C. A red team provider should maintain its own robust incident response plan, since compromise of its own infrastructure could expose sensitive client data, tooling, or ongoing engagement information across multiple clients, creating a significant, cascading risk
• D. Providers do not need their own incident response plan, since they only ever attack other organisations' systems

Explanation: Only visible for iPassleader members. You can sign-up / login (it's free).

Which of the following best distinguishes a "crown jewels" (asset-based) scoping approach from an
"objectives-based" (flag-based) scoping approach?

• A. They are identical approaches with different names
• B. A crown jewels approach centres scope around protecting specific high-value assets, while an objectives-based approach defines success around achieving specific goals (e.g., "obtain access to the payments system") without necessarily pre-defining every asset involved
• C. Objectives-based scoping never involves any technical systems
• D. Crown jewels scoping is illegal under CBEST

Explanation: Only visible for iPassleader members. You can sign-up / login (it's free).