Red Team Engagement Planning and Reporting GRTP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A red team has completed an engagement and is preparing the final report. The client's executive team wants a single risk score, but the technical team wants detailed findings. The red team lead must decide how to present the findings. Which approach best balances both needs?

   • AProvide only the overall risk score and omit technical details to keep the report concise.
   • BProvide only the technical details and let the executives derive the risk score themselves.
   • CProvide two separate reports, one for executives and one for technical staff, with no overlap.
   • DProvide an executive summary with an overall risk score and a separate technical appendix with detailed findings and remediation steps.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A red team has identified a finding that is rated 'high' severity but has a very low likelihood of exploitation because it requires physical access to a highly secured facility. The client's security team wants to deprioritize it. The red team lead must decide how to present this finding. What is the most appropriate action?

   • ARemove the finding from the report because it is unlikely to be exploited.
   • BPresent the finding with its high severity rating but clearly explain the low likelihood and the conditions required for exploitation, so the client can make an informed risk decision.
   • CDowngrade the severity to 'low' because the likelihood is low.
   • DKeep the finding but do not provide any context, so the client can decide on their own.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A red team is writing the final report for an engagement. They have a finding that is rated 'medium' severity but has a high likelihood of exploitation. How should this finding be presented in the report?

   • AUpgrade the severity to 'high' because the likelihood is high.
   • BDowngrade the severity to 'low' because the impact is only medium.
   • CPresent the finding with its severity rating and clearly explain the likelihood and potential business impact, so the client can make an informed remediation decision.
   • DOmit the finding from the report because it is not critical.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A red team is planning an engagement that involves testing a client's incident response (IR) capabilities. The client wants the red team to simulate a realistic attack, but the IR team is not aware of the engagement. The client's legal team is concerned about the risk of a real incident being triggered by the simulation, which could cause panic or legal liability. How should the red team address this risk in the engagement plan?

   • AProceed without informing the IR team and accept the risk of panic, as it is part of the test.
   • BCancel the IR testing portion of the engagement to eliminate the risk.
   • CDefine a 'stop-loss' condition in the RoE that allows the red team to halt the simulation if the IR team escalates to a real incident response.
   • DInform the IR team of the engagement to avoid panic, but this will reduce the realism of the test.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the purpose of classifying findings by severity in a red team report?

   • ATo help stakeholders understand which issues pose the greatest risk and should be addressed first
   • BTo replace the need for detailed technical explanations
   • CTo make the report longer and more detailed
   • DTo comply with international standards that require severity ratings
   Reveal Solution Discussion Select an answer first