先試後買

A. It is a private consultancy unrelated to any regulator

B. It is the sole accreditation body for CBEST providers, replacing CREST

C. It is a cross-industry, Bank of England-convened forum that supports coordination of operational resilience initiatives, including intelligence-led testing, across the UK financial sector

D. It has no relationship to sector-wide resilience testing coordination

A. Version history has no practical value and is included purely as a formality

B. Version history is only relevant to software development documents, not RoE documents

C. A clear version history and change log provides an auditable record of exactly what rules applied at any given point during the engagement, which is important given that the RoE may be legitimately updated over the course of a lengthy engagement

D. Version history exists solely to track the provider's billing history

A. Day-to-day IT security operations should always govern the testing programme directly

B. Keeping these distinct helps preserve the independence and objectivity of the testing programme's oversight, and avoids the conflicts of interest that could arise if the same people governed both the assessment and the thing being assessed

C. There is no meaningful distinction to maintain; they are the same governance function

D. This distinction is only relevant for engagements delivered under CBEST

A. Group-wide systems can never legally be tested under any circumstances

B. Only the CEO's personal consent is ever legally sufficient for any system

C. If the shared system is actually owned, controlled, or shared with other business units or group entities that have not consented, the single business unit's consent may not extend to cover the full scope of systems, data, or interests actually affected by testing

D. Consent from any single business unit is always sufficient regardless of system ownership

A. iCAST is a purely automated scanning tool with no human-led phases

B. iCAST combines all phases into a single unannounced 24-hour test

C. iCAST follows a broadly similar intelligence-led structure - scoping, threat intelligence, simulated attack/red teaming, and reporting/closure - reflecting its conceptual lineage from frameworks like CBEST

D. iCAST has no phases at all, unlike CBEST

A. A closure meeting adds no value beyond the written report itself

B. Closure meetings should only ever include the most senior executive, excluding all technical stakeholders

C. Closure meetings should occur before, rather than after, the report is finalised and delivered

D. A closure meeting allows stakeholders to ask questions, seek clarification, discuss prioritisation and next steps, and ensures key messages are genuinely understood, rather than risking misinterpretation of a purely written deliverable

A. Bank of England guidance setting out how CBEST engagements should be planned, governed, and executed

B. A piece of primary legislation passed by Parliament

C. An ISO technical standard

D. A CREST members-only marketing brochure

A. Stakeholder identification is unnecessary; the Red Team provider can proceed with technical planning alone

B. Only the CEO needs to be identified; all other stakeholders are irrelevant

C. Stakeholders are only relevant during the closure/reporting phase, never during scoping

D. Ensuring relevant stakeholders are identified and engaged early helps secure genuine authority for scope decisions, surface constraints or risks the provider may not otherwise know about, and support smooth escalation during testing

A. Such paths may be reflected in the scenario design where relevant and where appropriate arrangements (including third-party consent where direct testing is involved) can be made, otherwise they are documented as risk for the entity's own supply-chain risk management

B. Any mention of a third party immediately invalidates the entire test

C. Third parties are always automatically included in the test scope without consent

D. TIBER-EU explicitly prohibits ever considering third-party risk

A. It refers exclusively to the three phases of testing (scoping, testing, closure)

B. It refers to a governance model distinguishing operational management (first line), risk/compliance oversight functions (second line), and independent assurance such as internal audit (third line), each playing a distinct role in overseeing the programme's effectiveness

C. It refers to three separate Red Team providers being used simultaneously

D. It has no relevance to red team governance whatsoever

A. The Red Team Test Report

B. The Attestation Letter

C. The Blue Team Report

D. The Scope Specification Document (SSD)

A. Payload behaviour is irrelevant to Rules of Engagement and does not need to be discussed

B. Only entirely inert, non-executing files should ever be used, regardless of engagement objectives

C. Only fully functional, genuinely destructive malware should ever be used, for maximum realism

D. The RoE should clearly specify the nature and limitations of any payloads used (e.g., non-destructive, clearly attributable/benign proof-of-concept code, with defined behaviour and safe removal/cleanup process), balancing realism against unacceptable risk

A. This decision should be made entirely by an automated risk-scoring tool with no human judgement

B. Technical staff are always better placed to make this decision alone, given their expertise

C. High-risk scenario decisions should always default to whichever option is cheapest to execute

D. High-risk decisions with potential material business impact should be made by those with genuine accountability and authority for the organisation's overall risk position, informed by (but not solely determined by) technical input from the Red Team

A. Internal QA review has no bearing on report quality or client trust

B. Internal QA review exists solely to inflate the reported number of findings

C. Internal QA review helps ensure findings are accurate, well-substantiated, clearly communicated, and consistent with agreed scope and professional standards before reaching the client, protecting both report quality and the provider's professional credibility

D. Internal QA review should only occur if specifically requested by the client

A. Self-certified with no external assessment

B. Not required to hold any specific accreditation

C. Assessed and accredited against defined CREST/Bank of England criteria before being permitted to deliver engagements

D. Chosen solely based on lowest bid price