Question bank
Certified Red Team Manager
40 Certified Red Team Manager questions with the correct answer and a written explanation, organised across 6 exam domains.
- 40 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Communication, Deconfliction, and Professionalism
4 questions in this domain
- Question 1Single Choice
What is the primary role of the Red Team Manager during crisis communication?
- ALead the technical investigation
- BCentral communication nodeCorrect answer
- CDirectly contact law enforcement
- DBlame the responsible team member
Why this is the answer
The RTM acts as the coordinator for controlled information release and stakeholder communication.
- Question 2Multiple Select
Which two elements are essential for a deconfliction procedure?
- APre-defined escalation matrixCorrect answer
- BOut-of-band communication channelCorrect answer
- CDaily status meeting
- DEmail distribution list
Why this is the answer
Deconfliction relies on a clear escalation path and a dedicated real-time channel.
- Question 3Interactive
Based on the code block, which report section contains this evidence?
- AExecutive Summary
- BTechnical AnnexCorrect answer
- CAttack Narrative
- DRecommendations
Why this is the answer
Raw command logs and outputs are stored in the Technical Annex for reproducibility.
- Question 4Single Choice
What is the primary goal of mentorship in a red team context?
- AIncrease billable hours
- BTransfer leadership skills and ethicsCorrect answer
- CReplace junior staff
- DReduce operational costs
Why this is the answer
Mentorship develops future leaders by instilling strategic thinking and professional ethics.
Defensive Engagement and Blue Team Integration
6 questions in this domain
- Question 5Single Choice
What is the primary goal of deconfliction between Red and Blue teams?
- AHide red team activities from the SOC
- BNotify the SOC of authorized simulationsCorrect answer
- CIncrease competition between teams
- DReduce the red team's workload
Why this is the answer
Deconfliction is a transparency process that prevents false alarms by informing the SOC about authorized red team traffic.
- Question 6Multiple Select
Which two actions are essential for effective Red-Blue collaboration?
- ABidirectional knowledge transferCorrect answer
- BRed team dominance over operations
- CShared metrics and KPI alignmentCorrect answer
- DKeeping TTPs secret from the blue team
Why this is the answer
Effective collaboration requires two-way knowledge exchange and aligned performance metrics to improve overall security.
- Question 7Interactive
Based on the code block, what does the function primarily support during a purple team exercise?
- ADistinguish authorized traffic from threatsCorrect answer
- BBlock all unknown network connections
- CEncrypt all internal communications
- DPerform automated vulnerability scanning
Why this is the answer
The whitelist function helps deconflict red team traffic, preventing false positives during purple team exercises.
- Question 8Single Choice
What is the first step in a purple team engagement?
- AExecute the attack scenario
- BDefine scope and rules of engagementCorrect answer
- CAnalyze detection logs
- DPatch all discovered vulnerabilities
Why this is the answer
The first step is planning: defining the scope and rules of engagement to align objectives and prevent operational harm.
- Question 9Multiple Select
Which two metrics are used to measure detection effectiveness in red team results?
- ATime-to-Detect (TTD)Correct answer
- BNumber of vulnerabilities found
- CTime-to-Contain (TTC)Correct answer
- DTotal system uptime
Why this is the answer
TTD measures detection speed and TTC measures containment speed; both quantify blue team response effectiveness.
- Question 10Interactive
Using the code, how is Time-to-Detect (TTD) calculated for a red team action?
- AElapsed time from action to detectionCorrect answer
- BTotal number of alerts generated
- CPercentage of actions detected
- DSeverity score of the action
Why this is the answer
TTD is the time difference between the attacker's action timestamp and the blue team's alert timestamp.
Governance, Risk, and Compliance (GRC) for Red Teams
4 questions in this domain
- Question 11Single Choice
During a red team engagement, the team discovers personal data in a database that was previously marked as out-of-scope. What is the first action the red team manager should take?
- AHalt access and notify the client’s Data Protection Officer (DPO)Correct answer
- BContinue testing and document the data later
- CIsolate the database and proceed with the original plan
- DIgnore the data because it is out of scope
Why this is the answer
According to GDPR Article 33, any personal data breach, including accidental access, must be reported. The red team must stop and notify the DPO immediately to assess notification requirements.
- Question 12Multiple Select
Which two of the following statements correctly describe PCI DSS requirements for red team testing?
- AUse synthetic or test PANs when verifying CDE segmentationCorrect answer
- BObtain written authorization before any testing that targets the cardholder data environmentCorrect answer
- CConduct a full breach of the CDE to prove vulnerabilities exist
- DIgnore incident response procedures because it is a controlled test
Why this is the answer
PCI DSS requires the use of non-real card data for testing (Req 11.3) and explicit written authorization (Req 11.3.1). Full breaches or ignoring incident response violate PCI requirements.
- Question 13Interactive
In the Rules of Engagement excerpt below, which essential clause is missing based on the CCRTM best practices?
- ARules of DisengagementCorrect answer
- BAttack vector limitations
- CData handling procedures
- DCommunication protocols
Why this is the answer
RoE must specify when and how to stop (disengagement triggers). The snippet includes scope, attack vector limits, data handling, and communication, but lacks disengagement rules.
- Question 14Single Choice
Which statement best describes the difference between a vulnerability and a risk in a red team context?
- ARisk combines threat likelihood, vulnerability, and business impactCorrect answer
- BVulnerability is always a higher priority than risk
- CRisk is the same as the CVSS score of a vulnerability
- DVulnerability can be ignored if the asset is low value
Why this is the answer
Risk is a function of threat, vulnerability, and impact. CVSS measures vulnerability severity but not risk without business context.
Red Team Management and Leadership
10 questions in this domain
- Question 15Single Choice
What is the initial step in defining red team objectives?
- AEngage key stakeholdersCorrect answer
- BSelect exploitation tools
- CLaunch phishing campaigns
- DWrite the final report
Why this is the answer
Engaging stakeholders ensures objectives align with business risk and legal constraints.
- Question 16Multiple Select
Which documents are essential for defining red team scope? (Select two)
- ARules of EngagementCorrect answer
- BRisk RegisterCorrect answer
- CFirewall Logs
- DVulnerability Scan Results
Why this is the answer
The RoE defines legal boundaries and the risk register maps objectives to business risks.
- Question 17Interactive
What does the following snippet define in a red team operation?
- AA stop conditionCorrect answer
- BA privilege escalation technique
- CA data exfiltration method
- DA phishing template
Why this is the answer
The snippet shows an abort condition (if system crashes, abort) which is a stop condition in RoE.
- Question 18Single Choice
Who is responsible for defining the red team's success criteria?
- ARed Team ManagerCorrect answer
- BBlue Team Lead
- CSystem Administrator
- DExternal Auditor
Why this is the answer
The Red Team Manager defines objectives and success criteria aligned to business risk.
- Question 19Multiple Select
Which factors should be considered when building a high-performance red team? (Select two)
- ASkill matrix and targeted recruitmentCorrect answer
- BContinuous training and certification pathwayCorrect answer
- CPurchasing the most expensive tools
- DMaximizing number of engagements per quarter
Why this is the answer
Skill gaps and professional development are foundational; expensive tools or high frequency do not guarantee performance.
- Question 20Interactive
What does the following code represent in red team resource planning?
- ASkill mapping matrixCorrect answer
- BDaily stand-up agenda
- CBudget spreadsheet
- DAfter-action review template
Why this is the answer
The code defines a structured skill mapping with required proficiency levels, representing team capability planning.
- Question 21Single Choice
What is the primary purpose of deconfliction in red team operations?
- AAvoid alert fatigue and false positivesCorrect answer
- BIncrease the stealth of red team activities
- CReduce the cost of infrastructure
- DSpeed up the reconnaissance phase
Why this is the answer
Deconfliction prevents blue team from mistaking red team activity for a real incident.
- Question 22Multiple Select
Which are acceptable methods to motivate a red team? (Select two)
- AProvide autonomy in tool selectionCorrect answer
- BLink tasks to a broader missionCorrect answer
- COffer bonuses for zero-detection campaigns
- DAssign all operators to a single attack vector
Why this is the answer
Autonomy and purpose drive intrinsic motivation; financial bonuses may encourage unethical behaviour.
- Question 23Interactive
What does the following line represent in operational planning?
- ARules of Engagement boundaryCorrect answer
- BPhishing campaign objective
- CInfrastructure cost estimate
- DTeam rotation schedule
Why this is the answer
The snippet explicitly restricts scanning to 10.0.0.0/8, which is a scope boundary defined in RoE.
- Question 24Single Choice
What is the red team manager's primary legal responsibility during an engagement?
- AAdherence to signed Rules of EngagementCorrect answer
- BPublic disclosure of vulnerabilities found
- CMaximum exploitation of all systems
- DAvoiding any communication with blue team
Why this is the answer
The RoE is a legally binding document; deviating from it may constitute a criminal offense.
Technical Attack Lifecycle Management
8 questions in this domain
- Question 25Single Choice
According to the CREST Certified Red Team Manager (CCRTM) context, what is the definition of an APT simulation?
- AA highly structured, objective-driven offensive security exercise that mimics the TTPs of a specific APT over an extended period.Correct answer
- BA one-time vulnerability assessment focused on identifying exploitable weaknesses.
- CA continuous automated scanning process for compliance validation.
- DA penetration test that emphasizes speed over stealth.
Why this is the answer
An APT simulation is a structured, objective-driven exercise that emulates a specific threat actor's TTPs over an extended period, testing detection and response rather than just vulnerability discovery.
- Question 26Multiple Select
Which of the following are key concepts in Technical Attack Lifecycle Management as described in the CCRTM playbook? (Select all that apply.)
- AThreat Actor ProfilingCorrect answer
- BInfrastructure Lifecycle ManagementCorrect answer
- CPhishing Campaign Execution
- DMetrics and Reporting for StakeholdersCorrect answer
Why this is the answer
Key concepts include Threat Actor Profiling, Infrastructure Lifecycle Management, and Metrics and Reporting. Phishing Campaign Execution is a tactical activity, not a management concept.
- Question 27Interactive
Review the following document snippet. What type of document is this?
- ARules of Engagement (RoE)Correct answer
- BThreat Actor Profile
- CExfiltration Plan
- DIncident Response Plan
Why this is the answer
The snippet defines scope, exclusions, time windows, and communication channels, which are typical components of the Rules of Engagement (RoE).
- Question 28Single Choice
What is the primary purpose of threat actor profiling in an APT simulation?
- ATo map a real-world APT group's known TTPs and align them with the organization's threat landscapeCorrect answer
- BTo assign blame to a specific nation-state for the simulation
- CTo create a generic attacker profile that covers all possible threats
- DTo choose the most advanced tools available
Why this is the answer
Threat actor profiling involves selecting a real-world APT group and mapping their TTPs to ensure the simulation is realistic and relevant to the organization's risks.
- Question 29Multiple Select
Which of the following are responsibilities of the Red Team Manager concerning infrastructure lifecycle management? (Select all that apply.)
- APlanning setup, tear-down, and rotation of C2 infrastructureCorrect answer
- BEnsuring certificates and domains are managed properlyCorrect answer
- CManually deploying all redirectors and payloads
- DApproving the budget for cloud instances
Why this is the answer
The manager plans the infrastructure lifecycle including setup, rotation, and tear-down, and oversees certificate and domain management. Actual deployment is done by operators.
- Question 30Interactive
Examine the command in the code block. Which phase of the multi-stage attack chain does this represent?
- AInitial Access
- BPersistenceCorrect answer
- CLateral Movement
- DExfiltration
Why this is the answer
The command creates a scheduled task that runs on user logon, which is a persistence mechanism designed to maintain access.
- Question 31Single Choice
What is the primary difference between an APT simulation and a standard penetration test according to the CCRTM?
- AAPT simulation tests detection and response over weeks/months; penetration test focuses on vulnerability discovery in daysCorrect answer
- BAPT simulation uses only automated tools; penetration test is manual
- CAPT simulation is always announced to the blue team; penetration test is covert
- DAPT simulation does not require rules of engagement
Why this is the answer
APT simulations are prolonged exercises testing detection and response, while penetration tests are point-in-time vulnerability assessments.
- Question 32Multiple Select
Which of the following are considered living-off-the-land (LOTL) techniques? (Select all that apply.)
- APowerShellCorrect answer
- BWMICorrect answer
- CDeploying a custom C# agent
- DUsing certutil for file transfersCorrect answer
Why this is the answer
LOTL techniques abuse legitimate system tools like PowerShell, WMI, and certutil to avoid dropping custom malware.
Threat Intelligence and Adversary Emulation
8 questions in this domain
- Question 33Single Choice
Who is accountable for integrating threat intelligence into red team operations?
- AThreat Intelligence Analyst
- BRed Team ManagerCorrect answer
- CBlue Team Lead
- DEngagement Owner
Why this is the answer
Per the document, the red team manager is always accountable for integration, even if others execute tasks.
- Question 34Multiple Select
Which of the following are valid sources of threat intelligence for red team operations? (Select all that apply)
- AOpen-source intelligence (OSINT)Correct answer
- BCommercial vendor reportsCorrect answer
- CInternal threat hunting dataCorrect answer
- DOnly classified intelligence feeds
Why this is the answer
The document states that OSINT, commercial, and internal sources are valid when properly analyzed, and not all intelligence needs to be classified.
- Question 35Interactive
Based on the code block above, what does T1566.001 represent in the emulation plan?
- AIndicator of Compromise
- BMITRE ATT&CK TechniqueCorrect answer
- CRules of Engagement
- DThreat Actor Name
Why this is the answer
T1566.001 is a MITRE ATT&CK technique ID for Spearphishing Attachment, used to map adversary behavior.
- Question 36Single Choice
What is the primary purpose of the Cyber Kill Chain framework in red team scenario design?
- ASequencing the phases of an attackCorrect answer
- BCataloging all known adversary techniques
- CPredicting attacker's next move
- DStoring indicators of compromise
Why this is the answer
The Cyber Kill Chain provides a time-ordered flow of attack phases, from reconnaissance to actions on objectives.
- Question 37Multiple Select
Which of the following frameworks are explicitly mentioned as complementary to MITRE ATT&CK for emulation planning? (Select all that apply)
- ACyber Kill ChainCorrect answer
- BDiamond ModelCorrect answer
- COODA loopCorrect answer
- DNIST Cybersecurity Framework
Why this is the answer
The document mentions Cyber Kill Chain, Diamond Model, and OODA loop as complementary frameworks.
- Question 38Interactive
The output shown in the code block is an example of which red team management process?
- AFeedback loopCorrect answer
- BRules of Engagement
- CScenario playbook
- DDetection gap analysis
Why this is the answer
This feedback loop identifies intelligence gaps and communicates them to the client's threat intelligence team as per the document.
- Question 39Single Choice
What is the primary output of TTP decomposition in adversary profiling?
- AOperational playbookCorrect answer
- BThreat intelligence report
- CList of indicators of compromise
- DRisk assessment matrix
Why this is the answer
The document states that TTP decomposition produces an operational playbook with step-by-step actions and decision branches.
- Question 40Multiple Select
Which of the following are considered essential safety controls when designing realistic attack scenarios? (Select all that apply)
- AA kill switch mechanismCorrect answer
- BA separated network segment for testingCorrect answer
- CA hard stop timeCorrect answer
- DUse of zero-day exploits
Why this is the answer
The document mentions kill switch, separated segment, and hard stop time as essential. Zero-days are not safety controls.
Frequently asked questions
Everything about the Certified Red Team Manager question bank and how to use it.