Which of the following best describes appropriate escalation governance if the Control Team Lead becomes unexpectedly unavailable (e.g., due to illness) during a critical point in live testing?

• A. Testing should be permanently terminated the moment the Control Team Lead becomes unavailable, with no possibility of continuing under a deputy
• B. The Red Team provider should assume full decision-making authority in the client's absence
• C. A pre-identified deputy or alternate decision-maker, with clearly documented equivalent authority, should be available to maintain continuity of governance and decision-making during any such absence
• D. Testing should simply continue with no defined decision-maker until the Control Team Lead returns, however long that takes

解説: (Fast2test メンバーにのみ表示されます)

Comparing CBEST, TIBER-EU, and iCAST at a high level, which statement is most accurate?

• A. They apply exclusively to non-financial critical national infrastructure sectors
• B. Only one of the three actually involves any live testing; the others are purely documentation exercises
• C. They share a common conceptual lineage as intelligence-led, scenario-based testing frameworks for financial sector resilience, while differing in scheme ownership, jurisdiction, specific governance terminology, and detailed procedural requirements
• D. They are functionally identical schemes with no differences whatsoever, just different names

解説: (Fast2test メンバーにのみ表示されます)

Which of the following best describes the primary responsibility of a Red Team Manager overseeing delivery of a live engagement?

• A. Ensuring the engagement is properly resourced, risk-managed, governed, and delivered to professional standards, coordinating the technical team, client stakeholders, and governance processes throughout
• B. Personally performing all technical exploitation activity to the exclusion of the wider team
• C. Focusing exclusively on invoicing and commercial administration, with no involvement in delivery oversight
• D. Delegating all responsibility entirely to junior consultants with no oversight

解説: (Fast2test メンバーにのみ表示されます)

Which of the following is the most appropriate way to handle a request to include operational technology (OT) or industrial control systems (ICS) with potential life-safety implications within the scope of a red team engagement?

• A. Automatically exclude all OT/ICS systems from every engagement with no further discussion
• B. Allow testing to proceed without informing engineering or safety teams, to preserve realism
• C. Apply significantly enhanced caution - carefully assess whether live testing is appropriate at all, consider safer alternative approaches (e.g., testing in a representative non-production environment, or a more limited, closely supervised assessment), and involve relevant engineering/safety stakeholders in the scoping decision
• D. Include them in the same manner and with the same techniques as standard IT systems, with no special consideration

解説: (Fast2test メンバーにのみ表示されます)

Which of the following best describes the appropriate governance relationship between a firm's internal audit function and an intelligence-led testing programme?

• A. Internal audit has no legitimate interest in this programme
• B. Internal audit's involvement automatically invalidates the requirement for a Control Group
• C. Internal audit may appropriately review the programme's governance, process adherence, and remediation tracking as part of its independent assurance role, without necessarily needing to be involved in the sensitive operational detail of live testing itself
• D. Internal audit should directly manage and execute the Red Team testing activity itself

解説: (Fast2test メンバーにのみ表示されます)