13 お客様のコメント
質問 1：
A red team engagement spans multiple countries with differing computer misuse/cybercrime laws. What is the most professionally sound approach to managing this legal complexity?
A. Assume the laws of the provider's home country apply everywhere the testing occurs
B. Identify the specific legal requirements of each relevant jurisdiction, obtain appropriate local legal advice where needed, and ensure authorisation and Rules of Engagement properly address each jurisdiction's requirements
C. Ignore jurisdictional differences entirely, since cybercrime law is assumed to be identical worldwide
D. Only consider the jurisdiction where the client's head office is located, regardless of where systems are actually hosted or accessed from
正解：B
解説: (Pass4Test メンバーにのみ表示されます)
質問 2：
Which of the following is a key reason regulators in Hong Kong introduced an intelligence-led testing requirement like iCAST rather than relying solely on standard penetration testing?
A. Intelligence-led testing better reflects the realistic tactics of actual threat actors targeting the banking sector and evaluates detection/response, not just technical vulnerabilities
B. iCAST is significantly cheaper than any penetration test
C. Standard penetration testing was banned by CREST globally
D. Standard penetration testing is illegal in Hong Kong
正解：A
解説: (Pass4Test メンバーにのみ表示されます)
質問 3：
Which of the following best captures the relationship between the RoE and insurance/indemnity provisions discussed elsewhere in this domain?
A. The RoE is a purely insurance-industry document with no operational function
B. They are entirely unconnected; insurance never needs to be referenced in relation to the RoE
C. The RoE's operational boundaries (what is permitted, prohibited, and how risk is managed) directly shape the actual risk profile that insurance and indemnity provisions are designed to cover, so the two should be consistent with one another
D. Insurance automatically overrides and replaces the need for a Rules of Engagement document
正解：C
解説: (Pass4Test メンバーにのみ表示されます)
質問 4：
Which of the following best describes appropriate retention and eventual disposal of sensitive engagement data (logs, evidence, draft reports) held by the provider after the engagement has formally concluded?
A. Retention and disposal decisions are entirely at each individual consultant's personal discretion, with no organisational policy
B. All data should be deleted immediately upon report delivery, with absolutely no exceptions or retention period
C. Retention and disposal should follow an agreed, documented policy consistent with the contract and applicable data protection/record-keeping law, balancing legitimate retention needs (e.g., potential future reference, dispute resolution) against the risk of holding sensitive data longer than necessary
D. Sensitive data should be retained indefinitely by the provider, with no defined disposal process
正解：C
解説: (Pass4Test メンバーにのみ表示されます)
質問 5：
Which of the following best explains why "consent" obtained from a single business unit within a large, decentralised organisation may not be sufficient legal authorisation to test a shared, group-wide system?
A. Only the CEO's personal consent is ever legally sufficient for any system
B. Consent from any single business unit is always sufficient regardless of system ownership
C. Group-wide systems can never legally be tested under any circumstances
D. If the shared system is actually owned, controlled, or shared with other business units or group entities that have not consented, the single business unit's consent may not extend to cover the full scope of systems, data, or interests actually affected by testing
正解：D
解説: (Pass4Test メンバーにのみ表示されます)
質問 6：
Which of the following best reflects how the RoE should treat the use of testers' personal (non-client-issued, non-provider-issued) devices or accounts during an engagement?
A. Personal devices and accounts should always be used, since this best simulates real attacker behaviour
B. The client's own IT policy on personal devices is entirely irrelevant to the engagement
C. Personal device use is irrelevant to Rules of Engagement and does not need to be addressed
D. The RoE should typically require the use of approved, provider-managed and appropriately secured infrastructure and accounts, avoiding personal devices or accounts, to maintain security, accountability, and clear evidential/audit boundaries
正解：D
解説: (Pass4Test メンバーにのみ表示されます)
質問 7：
Why does CBEST specifically require testing against live production systems rather than test/staging environments?
A. Production environments are cheaper to test
B. Test environments rarely exist in financial institutions
C. Regulators are indifferent to environment choice
D. Only live production environments accurately reflect the real configuration, data flows, and defensive posture that a genuine attacker would encounter
正解：D
解説: (Pass4Test メンバーにのみ表示されます)
A red team engagement spans multiple countries with differing computer misuse/cybercrime laws. What is the most professionally sound approach to managing this legal complexity?
A. Assume the laws of the provider's home country apply everywhere the testing occurs
B. Identify the specific legal requirements of each relevant jurisdiction, obtain appropriate local legal advice where needed, and ensure authorisation and Rules of Engagement properly address each jurisdiction's requirements
C. Ignore jurisdictional differences entirely, since cybercrime law is assumed to be identical worldwide
D. Only consider the jurisdiction where the client's head office is located, regardless of where systems are actually hosted or accessed from
正解：B
解説: (Pass4Test メンバーにのみ表示されます)
質問 2：
Which of the following is a key reason regulators in Hong Kong introduced an intelligence-led testing requirement like iCAST rather than relying solely on standard penetration testing?
A. Intelligence-led testing better reflects the realistic tactics of actual threat actors targeting the banking sector and evaluates detection/response, not just technical vulnerabilities
B. iCAST is significantly cheaper than any penetration test
C. Standard penetration testing was banned by CREST globally
D. Standard penetration testing is illegal in Hong Kong
正解：A
解説: (Pass4Test メンバーにのみ表示されます)
質問 3：
Which of the following best captures the relationship between the RoE and insurance/indemnity provisions discussed elsewhere in this domain?
A. The RoE is a purely insurance-industry document with no operational function
B. They are entirely unconnected; insurance never needs to be referenced in relation to the RoE
C. The RoE's operational boundaries (what is permitted, prohibited, and how risk is managed) directly shape the actual risk profile that insurance and indemnity provisions are designed to cover, so the two should be consistent with one another
D. Insurance automatically overrides and replaces the need for a Rules of Engagement document
正解：C
解説: (Pass4Test メンバーにのみ表示されます)
質問 4：
Which of the following best describes appropriate retention and eventual disposal of sensitive engagement data (logs, evidence, draft reports) held by the provider after the engagement has formally concluded?
A. Retention and disposal decisions are entirely at each individual consultant's personal discretion, with no organisational policy
B. All data should be deleted immediately upon report delivery, with absolutely no exceptions or retention period
C. Retention and disposal should follow an agreed, documented policy consistent with the contract and applicable data protection/record-keeping law, balancing legitimate retention needs (e.g., potential future reference, dispute resolution) against the risk of holding sensitive data longer than necessary
D. Sensitive data should be retained indefinitely by the provider, with no defined disposal process
正解：C
解説: (Pass4Test メンバーにのみ表示されます)
質問 5：
Which of the following best explains why "consent" obtained from a single business unit within a large, decentralised organisation may not be sufficient legal authorisation to test a shared, group-wide system?
A. Only the CEO's personal consent is ever legally sufficient for any system
B. Consent from any single business unit is always sufficient regardless of system ownership
C. Group-wide systems can never legally be tested under any circumstances
D. If the shared system is actually owned, controlled, or shared with other business units or group entities that have not consented, the single business unit's consent may not extend to cover the full scope of systems, data, or interests actually affected by testing
正解：D
解説: (Pass4Test メンバーにのみ表示されます)
質問 6：
Which of the following best reflects how the RoE should treat the use of testers' personal (non-client-issued, non-provider-issued) devices or accounts during an engagement?
A. Personal devices and accounts should always be used, since this best simulates real attacker behaviour
B. The client's own IT policy on personal devices is entirely irrelevant to the engagement
C. Personal device use is irrelevant to Rules of Engagement and does not need to be addressed
D. The RoE should typically require the use of approved, provider-managed and appropriately secured infrastructure and accounts, avoiding personal devices or accounts, to maintain security, accountability, and clear evidential/audit boundaries
正解：D
解説: (Pass4Test メンバーにのみ表示されます)
質問 7：
Why does CBEST specifically require testing against live production systems rather than test/staging environments?
A. Production environments are cheaper to test
B. Test environments rarely exist in financial institutions
C. Regulators are indifferent to environment choice
D. Only live production environments accurately reflect the real configuration, data flows, and defensive posture that a genuine attacker would encounter
正解：D
解説: (Pass4Test メンバーにのみ表示されます)
国武** -
仕事で使うようになり勉強開始。
偏差値真ん中くらいの自分でも、内容もわかりやすくて助かります！試験は受けないので、CCRTM-MCLF勉強にいいかも。