Which factor most directly explains why GBEST-style government-sector testing may involve governance considerations not present in CBEST-style financial-sector testing?

• A. Financial regulation and government security governance are administered by exactly the same body
• B. There are no meaningful differences whatsoever between government and financial-sector testing governance
• C. Government systems may involve additional considerations such as national security classifications, differing legal authorities, and public sector accountability structures that shape how testing is authorised and governed
• D. Government departments never use any external providers

Explanation: Only visible for PremiumVCEDump members. You can sign-up / login (it's free).

Which of the following best describes the appropriate final step that formally concludes a well-governed intelligence-led testing engagement?

• A. The engagement is considered concluded the moment the final invoice is paid, regardless of any other outstanding activity
• B. Formal closure typically involves agreement between the Control Group and provider (and, where relevant, the overseeing authority via attestation) that reporting, debrief, and remediation planning have been appropriately completed, with the engagement then formally recorded as closed
• C. Formal closure occurs automatically at a fixed calendar date with no reference to actual deliverable completion
• D. There is no defined concept of formal closure; engagements simply end when the team stops working

Explanation: Only visible for PremiumVCEDump members. You can sign-up / login (it's free).

Which of the following best describes appropriate board-level governance oversight of a firm's intelligence- led testing programme?

• A. Board oversight is irrelevant to cyber resilience testing programmes
• B. The board should personally review every technical finding in granular detail before any remediation can begin
• C. The board (or a delegated board risk committee) should receive appropriately summarised, risk-focused reporting on programme outcomes and remediation progress, supporting its overall risk oversight responsibilities, without necessarily requiring exposure to highly sensitive technical detail
• D. The board should be entirely excluded from any awareness of the programme, for confidentiality reasons

Explanation: Only visible for PremiumVCEDump members. You can sign-up / login (it's free).

Which of the following best describes appropriate governance around procurement and provider selection for an intelligence-led testing engagement?

• A. Provider selection has no meaningful governance dimension and can be delegated entirely without oversight
• B. Provider selection should be based solely on the lowest quoted price, with no other criteria
• C. Provider selection should be a governed process considering factors such as relevant accreditation, demonstrated competence, appropriate staff vetting, references, and cultural/operational fit, alongside commercial terms
• D. Only providers personally known to the CEO should ever be considered

Explanation: Only visible for PremiumVCEDump members. You can sign-up / login (it's free).

If threat intelligence gathered for a CBEST engagement identifies a nation-state actor as implausible for the specific firm's risk profile, what should the Red Team scenario reflect instead?

• A. A randomly selected actor from an unrelated industry
• B. No scenario at all, since only nation-state actors are valid for CBEST
• C. The nation-state actor should still be used regardless of plausibility, for maximum technical challenge
• D. A scenario built around the threat actor(s) genuinely assessed as plausible and relevant to that firm, even if less sophisticated than a nation-state