Which of the following best describes the primary responsibility of a Red Team Manager overseeing delivery of a live engagement?

• A. Delegating all responsibility entirely to junior consultants with no oversight
• B. Ensuring the engagement is properly resourced, risk-managed, governed, and delivered to professional standards, coordinating the technical team, client stakeholders, and governance processes throughout
• C. Focusing exclusively on invoicing and commercial administration, with no involvement in delivery oversight
• D. Personally performing all technical exploitation activity to the exclusion of the wider team

Which of the following best describes why a Red Team Manager should ensure clear internal documentation of decisions made and their rationale throughout an engagement's delivery, separate from client-facing reporting?

• A. Internal documentation should be actively avoided, to reduce the risk of it being discoverable in future disputes
• B. Internal documentation is only useful for very large, multinational providers
• C. Internal documentation serves no purpose beyond client-facing reporting
• D. Internal documentation of decisions and rationale supports internal quality assurance, provides continuity if personnel change, and creates a valuable internal record for future learning and, if ever needed, for demonstrating the professional basis for decisions made

What is the primary purpose of iCAST within an Authorized Institution's cyber resilience programme?

• A. To provide realistic, evidence-based insight into how the AI's people, processes and technology would withstand a plausible, targeted cyberattack
• B. To satisfy a purely administrative box-ticking exercise with no bearing on real security
• C. To certify the AI's core banking software vendor
• D. To replace the need for any Inherent Risk Assessment

A firm considering whether to pursue STAR/STAR-FS testing asks whether the results carry any formal regulatory recognition comparable to CBEST attestation. What is the most accurate response?

• A. STAR/STAR-FS results are always automatically recognised as equivalent to formal regulator- mandated scheme outcomes in every respect
• B. STAR/STAR-FS results have absolutely no value to any stakeholder
• C. Only the Red Team provider's opinion matters; no regulator would ever be interested
• D. While STAR/STAR-FS provides rigorous, CREST-governed assurance and can be a credible input to a firm's own risk management and board reporting, firms should confirm with their own supervisor how (if at all) such voluntary testing is formally recognised, since this differs from being designated into a scheme like CBEST or DORA TLPT

Which statement best reflects how criminal liability risk under laws like the Computer Misuse Act typically differs between a properly authorised red team engagement and unauthorised "grey hat" testing of the same systems?

• A. Grey hat testing is always legal as long as no data is actually stolen
• B. There is no difference; both carry identical criminal liability risk
• C. A properly authorised engagement, with documented authorisation from someone entitled to grant it and activity kept within agreed scope, is designed specifically to avoid meeting the "unauthorised" element of the relevant offences, whereas unauthorised "grey hat" testing (even with good intentions) risks meeting that element and incurring genuine criminal liability
• D. Authorisation is irrelevant to criminal liability under these laws