What is the most appropriate description of the relationship between CBEST and the UK's broader Operational Resilience regulatory framework (e.g., PRA/FCA rules on Important Business Services and impact tolerances)?

• A. CBEST determines a firm's statutory impact tolerances
• B. CBEST is one practical mechanism firms can use to test and evidence their resilience against cyberattack, complementing the broader operational resilience obligations around Important Business Services and impact tolerances
• C. They are entirely separate and unrelated regimes
• D. Operational Resilience rules replace the need for CBEST entirely

Explanation: Only visible for Pass4sures members. You can sign-up / login (it's free).

Which of the following best describes the concept of "Priority Intelligence Requirements" (PIRs) in the context of scoping a threat intelligence workstream for a red team engagement?

• A. PIRs are a synonym for the final Red Team Test Report
• B. PIRs are set exclusively by the Red Team technical delivery team, with no analyst input
• C. PIRs are the specific, prioritised questions the threat intelligence work needs to answer to support the engagement's objectives (e.g., "which threat actors are most plausible for this organisation's sector and geography?"), helping focus collection and analysis effort effectively
• D. PIRs are irrelevant to threat intelligence and belong only to military contexts

Explanation: Only visible for Pass4sures members. You can sign-up / login (it's free).

Which of the following best describes why scoping should explicitly address how the Red Team will handle discovery of an unrelated, apparently genuine security incident during testing?

• A. Because it is a realistic possibility with significant legal, operational, and reputational implications, having an agreed escalation process defined in advance ensures a swift, appropriate response rather than confusion or delay if it occurs
• B. This scenario should only be addressed after it has already happened
• C. This scenario is so rare it does not need to be addressed during scoping
• D. The Red Team should always assume any suspicious activity found is part of their own simulated scenario

Explanation: Only visible for Pass4sures members. You can sign-up / login (it's free).

Which of the following best describes appropriate structure for presenting findings in the technical body of a red team report?

• A. Findings should typically be organised logically (e.g., following the attack narrative/kill chain, or grouped by risk level), each with clear evidence, business impact/risk rating, and actionable remediation recommendations
• B. Findings should be presented with no evidence, relying solely on the tester's unsupported assertion
• C. Remediation recommendations should never be included, since that is the client's responsibility to determine
• D. Findings should be listed in a completely random order with no organising logic

Explanation: Only visible for Pass4sures members. You can sign-up / login (it's free).

Which role in iCAST is most directly comparable to the "Threat Intelligence Provider" role in CBEST and TIBER-EU?

• A. The AI's marketing department
• B. An accredited external provider that researches and produces intelligence on threat actors and attack scenarios plausible for the specific AI
• C. The HKMA's press office
• D. The AI's external auditor for financial statements

Explanation: Only visible for Pass4sures members. You can sign-up / login (it's free).