Which of the following best describes how governance of confidentiality should extend to the Red Team provider's own internal handling of client-sensitive material?

• A. Confidentiality obligations apply only to the client, never to the provider's internal practices
• B. The provider should apply its own robust internal governance - access controls, secure storage, need- to-know restriction, and staff confidentiality training - to protect client-sensitive material to a standard consistent with its contractual and professional obligations
• C. Confidentiality governance is solely the client's responsibility to enforce within the provider's organisation
• D. Internal governance of confidentiality is unnecessary as long as an NDA has been signed

Explanation: Only visible for PrepAwayExam members. You can sign-up / login (it's free).

Which statement best reflects the legal position if a red team, without authorisation, tests a third-party cloud provider's underlying infrastructure (rather than the client's own configuration within that cloud environment)?

• A. Client consent is entirely irrelevant to cloud testing
• B. Cloud infrastructure is legally unowned and therefore always fair game for testing
• C. This is generally not permissible without the cloud provider's own separate authorisation, since the client typically cannot grant authorisation over infrastructure it does not own or control; most cloud providers have specific published policies governing permitted security testing
• D. This is always permissible as long as the client consents, regardless of the cloud provider's own policies

Explanation: Only visible for PrepAwayExam members. You can sign-up / login (it's free).

Which of the following best describes governance considerations relevant to how a firm decides the overall cadence (e.g., annual, every three years) of its intelligence-led testing programme, beyond any specific regulatory minimum?

• A. Cadence should always be set to the absolute legal minimum permitted, with no further consideration
• B. Cadence should be decided solely by the Red Team provider, with no client governance input
• C. Cadence should reflect the firm's own risk assessment, pace of technological and organisational change, and evolving threat landscape, potentially exceeding any regulatory minimum where the firm's own risk profile justifies more frequent testing
• D. Cadence is irrelevant, since a single test is always sufficient regardless of subsequent organisational change

Explanation: Only visible for PrepAwayExam members. You can sign-up / login (it's free).

Which of the following best describes the purpose of maintaining and periodically updating internal methodology and knowledge management resources within a red team practice?

• A. Methodology documentation should never be updated once initially created, to preserve consistency
• B. Knowledge management is solely the concern of very large, multinational providers, irrelevant to smaller practices
• C. Methodology documentation has no practical benefit and is rarely maintained in professional practice
• D. Well-maintained methodology and knowledge resources support consistent quality, help onboard and train staff effectively, and ensure the practice's approach evolves to reflect current threat intelligence, techniques, and lessons learned

Explanation: Only visible for PrepAwayExam members. You can sign-up / login (it's free).

Which of the following best describes why detailed, time-stamped activity records maintained throughout the engagement (discussed earlier in the legal considerations domain) are particularly valuable during report writing and closure?

• A. Detailed activity records provide the accurate, evidence-based foundation needed to construct a credible attack narrative, substantiate findings, and support precise correlation with Blue Team logs during closure
• B. Activity records should be discarded before report writing begins, to keep the report concise
• C. Activity records are only useful if the engagement is later subject to a legal dispute
• D. These records have no particular relevance to report writing

Explanation: Only visible for PrepAwayExam members. You can sign-up / login (it's free).