Which of the following is the most appropriate handling approach for evidence (e.g., screenshots, extracted data samples) gathered to demonstrate successful exploitation during a red team engagement?

• A. Store all evidence indefinitely on personal, unencrypted devices
• B. Post interesting findings to a public technical blog immediately for professional recognition
• C. Extract and retain as much raw sensitive data as possible, without limitation, "just in case it's useful later"
• D. Apply data minimisation and proportionality - capture only what is genuinely necessary to demonstrate the finding, handle it securely, and dispose of it in line with the agreed contract terms and applicable data protection law

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Why is a written, signed authorisation document (sometimes informally called a "get out of jail" letter) considered essential before any red team engagement begins?

• A. It is only needed if the client requests it
• B. It has no legal significance and is purely a formality
• C. It provides documented evidence that authorisation was granted by someone with the authority to do so, which is central to establishing that access was not "unauthorised" under laws like the Computer Misuse Act
• D. It replaces the need for a Rules of Engagement document

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Which of the following best describes why scoping documentation should explicitly identify emergency contacts and an escalation path, separate from day-to-day project contacts?

• A. Emergency contacts are only relevant for physical, not technical, engagements
• B. Escalation paths should always route directly to the media relations team first
• C. In the event of an urgent issue (e.g., accidental disruption, discovery of a genuine incident) outside normal working hours or requiring rapid senior decision-making, having pre-identified emergency contacts and a clear escalation path enables a fast, appropriate response
• D. Emergency contacts are unnecessary if a Rules of Engagement document already exists

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Which of the following best describes why Rules of Engagement documents commonly include a defined document version history and change log?

• A. Version history exists solely to track the provider's billing history
• B. Version history is only relevant to software development documents, not RoE documents
• C. A clear version history and change log provides an auditable record of exactly what rules applied at any given point during the engagement, which is important given that the RoE may be legitimately updated over the course of a lengthy engagement
• D. Version history has no practical value and is included purely as a formality

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Which of the following best describes appropriate retention and eventual disposal of sensitive engagement data (logs, evidence, draft reports) held by the provider after the engagement has formally concluded?

• A. Sensitive data should be retained indefinitely by the provider, with no defined disposal process
• B. Retention and disposal should follow an agreed, documented policy consistent with the contract and applicable data protection/record-keeping law, balancing legitimate retention needs (e.g., potential future reference, dispute resolution) against the risk of holding sensitive data longer than necessary
• C. Retention and disposal decisions are entirely at each individual consultant's personal discretion, with no organisational policy
• D. All data should be deleted immediately upon report delivery, with absolutely no exceptions or retention period

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).