Why might a Red Team Manager advise discreetly informing a national CERT or relevant law enforcement liaison contact in advance of an engagement involving significant physical or overtly suspicious activity?

• A. Because it is a legal requirement for every single engagement without exception
• B. Because it transfers full legal responsibility for the test to law enforcement
• C. To reduce the risk of a genuine security or emergency response being triggered and to allow rapid de- escalation and correct attribution of activity to an authorised test, should such a response occur
• D. Because law enforcement must approve every technical detail of the test in advance

Explanation: Only visible for ITPassLeader members. You can sign-up / login (it's free).

Which of the following best describes why a Red Team Manager should maintain a documented succession or continuity plan for key roles (e.g., Test Director) on long-running or particularly critical engagements?

• A. Succession planning should only be considered after a key individual has already become unavailable
• B. Succession planning is unnecessary, since key individuals are assumed to always be available throughout any engagement
• C. Succession planning is solely a human resources concern with no bearing on engagement delivery
• D. A documented continuity plan reduces the risk of significant disruption to the engagement's governance, quality, or continuity if a key individual becomes unexpectedly unavailable

Explanation: Only visible for ITPassLeader members. You can sign-up / login (it's free).

For a Red Team Manager overseeing multiple intelligence-led engagements across jurisdictions, what is the most important practical implication of frameworks like iCAST, CBEST, and TIBER-EU having similar but not identical requirements?

• A. Each engagement must be planned against the specific scheme's actual governance, documentation, timing, and accreditation requirements, rather than assuming interchangeability across frameworks
• B. It is safe to apply exactly the same generic process and documentation across every jurisdiction without adaptation
• C. Jurisdictional differences are purely cosmetic and can be ignored by an experienced manager
• D. Only the Red Team's technical toolset needs to change between jurisdictions; governance can remain identical

Explanation: Only visible for ITPassLeader members. You can sign-up / login (it's free).

Which of the following best describes why independence of the quality assurance/Test Manager function from the delivery team is important?

• A. Independence has no bearing on the credibility of oversight
• B. Independence is only a theoretical concept with no practical governance application
• C. The delivery team should always self-assess its own quality with no external review
• D. Independence reduces the risk of conflicts of interest influencing quality assessments, supporting an objective, credible judgement on whether the engagement genuinely met required standards

Explanation: Only visible for ITPassLeader members. You can sign-up / login (it's free).

A prospective client asks a Red Team Manager whether social engineering testing involving employee personal email accounts (not provided by the employer) can be included in scope. What is the most legally sound response?

• A. It is irrelevant, since all testing activity is automatically covered by the general engagement contract
• B. This is always fully permissible with no additional consideration required
• C. This raises significant legal and ethical complexity, since the client cannot straightforwardly authorise access to accounts and data it does not own or control, and such testing generally should not be included without separate, specific consideration (and likely exclusion)
• D. Personal email testing is always required for a valid engagement

Explanation: Only visible for ITPassLeader members. You can sign-up / login (it's free).