CCRTM-SC最も有効な質問と解答で勉強

Background: You are the Red Team Manager on a CBEST engagement for Fenwick and Colne Bank. In the Closure phase, your team's detailed activity logs show that a specific technique - exploitation of a misconfigured internal API to extract a sample of authentication tokens - was successfully executed and went entirely undetected by the Blue Team throughout the six weeks of active testing. During the purple team replay session, when this specific finding is presented, the Head of Security Operations (a Blue Team member, now informed as part of Closure) becomes visibly defensive, states that "this API isn't even properly in our monitoring scope, so it's not a fair test," and requests that this specific finding be removed from the final Red Team Test Report because it "doesn't reflect a real gap, just an unfair technicality." Separately, your own internal review confirms the API in question was genuinely within the agreed CBEST technical scope throughout the engagement, and was reachable via a legitimately compromised, in-scope host using an authorised technique.
Question: How should you respond to the Head of Security Operations' request to remove the finding from the report, and what does this scenario illustrate about the purpose and proper handling of purple team replay sessions and final reporting integrity?

See The answer in Explanation part below.
Explanation:
Step 1 - Verify the facts before responding substantively. You have already confirmed (per the scenario) that the API was genuinely within agreed scope and was reached via a properly authorised technique from a legitimately compromised, in-scope host - this is an important first check, since if the finding genuinely had been out of scope, that would be a different, legitimate scope-boundary discussion. Given the facts are confirmed, the finding is legitimate and properly within scope.
Step 2 - Do not agree to remove a genuine, properly evidenced finding from the report. As established throughout this syllabus, objectivity and completeness in reporting are core professional obligations: findings must be reported based on genuine evidence and sound analysis, not adjusted or removed to spare a stakeholder's discomfort, however understandable that discomfort is. Removing a real, in-scope, properly evidenced detection gap because a Blue Team stakeholder finds it uncomfortable or feels it reflects poorly on their team would be a serious breach of reporting integrity and would directly deprive the organisation (and its board/regulator) of accurate, actionable insight into a genuine resilience gap - precisely the opposite of the exercise's purpose.
Step 3 - Engage constructively and empathetically with the underlying concern, without compromising the finding. The Head of Security Operations' defensiveness is a natural, human reaction and should be handled with empathy and professionalism, not dismissed harshly. You should acknowledge the discomfort directly, and constructively probe the substance of their objection: is the concern genuinely about scope (already addressed and resolved in Step 1), or is it really about monitoring coverage decisions that were made by the organisation itself (e.g., a prior decision not to include this API in monitoring scope) - which, if true, actually reinforces rather than undermines the finding's value, since it reveals a genuine, real-world monitoring coverage gap the organisation itself created and needs to know about.
Step 4 - Reframe the finding constructively, using the purple team session's real purpose. This is exactly the situation the purple team/replay session exists to work through collaboratively and non-punitively, as established in the syllabus: rather than a blame exercise, it should be used to jointly and constructively explore why the API was not in monitoring scope, whether that was a deliberate, risk-accepted decision or an oversight, and what a realistic, prioritised remediation path looks like - reframing the finding as a valuable, actionable input rather than a personal criticism of the Head of Security Operations or their team.
Step 5 - Maintain report objectivity while ensuring proportionate context is included. The finding should remain in the report, accurately described, with an appropriately assessed risk rating reflecting genuine business impact - but the report can, and should, include fair, accurate context (for example, factually noting the API's actual monitoring status at the time of testing, if relevant to understanding the finding) without this context being used to minimise, remove, or soften an accurate description of what actually happened.
Accuracy and fairness are not in tension here: an honest, complete, well-contextualised finding serves everyone's interests better than either an inflated or an artificially removed one.
Step 6 - Escalate if the request persists beyond a reasonable professional conversation. If the Head of Security Operations continues to insist on removal after this constructive discussion, this should be raised transparently with the Control Group, since a request to alter or remove a genuine, evidenced finding from a CBEST report is a serious integrity matter that the Control Group (not an individual Blue Team stakeholder, however senior within their own function) has the right and responsibility to be aware of and ultimately decide how to handle, consistent with this syllabus's repeated emphasis on escalating significant governance and integrity issues through the proper channel rather than resolving them informally or unilaterally.
Step 7 - Draw out the broader lesson about purple team sessions and reporting integrity. This scenario illustrates that purple team replay sessions are inherently sensitive because they can surface uncomfortable, personally or professionally difficult findings for defenders, and that maintaining strict reporting objectivity and integrity - while still handling the human dynamics with genuine empathy and constructive framing - is essential to the whole exercise retaining real value. A red team practice, and its individual Red Team Managers, must be willing to hold this line professionally even under direct, senior stakeholder pressure to soften or remove a genuine finding.
Conclusion: The finding is genuine, properly in scope, and correctly evidenced, and should remain accurately reported in the final Red Team Test Report; the Head of Security Operations' discomfort should be handled empathetically and constructively through the purple team process (potentially revealing a genuine, valuable underlying monitoring-scope decision worth surfacing), but this must not extend to removing or softening an accurate finding, and any persistent pressure to do so should be escalated transparently to the Control Group.
---

Background: You are the Red Team Manager for a 12-week TIBER-EU-aligned engagement. In week 7, your firm wins a large, unrelated new contract that your firm's leadership is keen to staff quickly, and you are asked by your own Practice Director to release your firm's second-most-senior consultant on the current engagement
- who has been leading the more technically complex of two parallel attack paths - to begin work on the new contract "part-time, starting Monday, just two days a week for now," while remaining nominally on the TIBER-EU engagement the other three days.
The consultant in question tells you privately that they do not believe they can properly context-switch between a slow-paced, patient, intelligence-led campaign requiring sustained situational awareness of a live target environment, and a fast-moving new client kickoff, without a real risk of errors or missed detail on one or both engagements. Separately, the client's Control Team Lead has no visibility yet of this proposed change and has previously stressed how much they value consistency of personnel on such a sensitive, lengthy engagement.
Question: As Red Team Manager, how would you handle this internal resourcing request from your own firm's leadership, balancing your firm's commercial interests against your professional obligations on the current TIBER-EU engagement? Explain your reasoning and the steps you would take.

See The answer in Explanation part below.
Explanation:
Step 1 - Take the consultant's own professional judgement seriously. The consultant's concern about the cognitive and quality risk of context-switching between a patient, sustained intelligence-led campaign and a fast-moving new engagement is a genuine, well-founded professional concern, directly consistent with the syllabus's treatment of resourcing, wellbeing, and the connection between sustained focus/reduced fragmentation and the quality and safety of live testing decisions. This should not be dismissed as reluctance or waved away by organisational hierarchy - it is exactly the kind of frontline risk signal a responsible Red Team Manager should weigh heavily.
Step 2 - Assess the genuine impact on the current engagement before agreeing to anything. Before responding to your Practice Director, you should concretely assess: how central this consultant's continued, undivided attention actually is to the remaining, more technically complex attack path; whether a reduced, split-attention arrangement could realistically maintain the standard of care and situational awareness the engagement requires (particularly given TIBER-EU's emphasis on sustained, patient, low-and-slow activity, which the syllabus notes a compressed or fragmented tempo can undermine); and whether any other resourcing option exists (e.g., a different, less centrally involved consultant being the one released instead, or a short delay to the new contract's start date).
Step 3 - Do not unilaterally agree to the change without raising it with the client first. Given the client's Control Team Lead has explicitly and previously valued personnel consistency on this sensitive engagement, quietly reducing this key consultant's involvement without informing them would be a significant transparency and governance failure - echoing the syllabus principle that clients should be informed proactively of matters materially affecting delivery, rather than left to discover changes after the fact. Even if you ultimately judge the reduced arrangement could work technically, informing the client's Control Team Lead in advance, and giving them the opportunity to raise any concern, is professionally and contractually the correct approach.
Step 4 - Push back constructively with your own firm's leadership, using evidence, not just refusal. You should raise your assessment (Steps 1-2) directly and professionally with your Practice Director: explaining the specific, concrete risk to quality and safety on a live, sensitive, regulator-relevant engagement, and the consultant's own well-founded professional concern, rather than either simply refusing outright with no explanation, or simply complying because of internal hierarchy pressure - consistent with the syllabus principle that a Red Team Manager must actively and transparently manage tension between commercial pressure and maintaining professional/safety standards, rather than letting commercial pressure automatically prevail.
Step 5 - Propose alternatives that could satisfy both needs. Rather than a binary "yes" or "no," propose constructive alternatives to your Practice Director: for example, releasing a different, less critically-placed team member for the new contract instead; a short, defined delay (e.g., one to two weeks) before this consultant transitions, timed to a genuine, planned handover point in the TIBER-EU engagement's own workplan; or bringing in additional short-term support to properly backfill and hand over the consultant's specific attack-path knowledge before any reduction in their time takes effect, consistent with the succession
/continuity planning principle discussed elsewhere in the syllabus.
Step 6 - If a change genuinely must proceed, manage it properly rather than allowing an uncontrolled drift.
If, after this escalation, your firm's leadership still determines the consultant must move to the new contract at least part-time, you should ensure this happens through a properly managed, documented transition - informing the client's Control Team Lead transparently with your own honest risk assessment, agreeing a specific handover plan and, if necessary, adjusting the TIBER-EU engagement's own remaining timeline or approach to reflect the reduced resourcing honestly, rather than pretending nothing has changed.
Step 7 - Reflect this into future capacity planning. This episode should be captured as a lessons-learned point about the firm's broader capacity planning practice: committing key personnel fully to sensitive, lengthy, regulator-relevant engagements needs to be genuinely protected against exactly this kind of internal competing-priority pressure, ideally through better forward capacity planning before new contracts are sold in, rather than resolved reactively each time it arises.
Conclusion: The consultant's professional concern about harmful context-switching should be taken seriously and used as the basis for pushing back constructively (not simply complying) with your own firm's commercial leadership; the client's Control Team Lead must be informed transparently before any change is made, given their previously stated value on personnel consistency; and if a change ultimately must proceed, it should be managed through a properly planned, documented, and client-informed transition rather than an unmanaged, silent reduction in a key consultant's involvement.
---