Question
Explain, with reasoning, (a) whether your team may proceed to test TrueClaim Systems Ltd’s backend infrastructure based on the authorisation held and the IT manager’s email, (b) how your team should handle the discovery of the underwriter’s personal Gmail usage, and (c) what governance step should follow the IT manager’s direct request.
A. See Explanation
Answer:
A
Explanation
Step 1 – Analyse the authorisation’s actual scope
The written authorisation covers systems owned and operated by Corvane Insurance Group and its wholly owned UK subsidiaries. TrueClaim Systems Ltd is a separate legal entity that owns and operates the underlying claims portal infrastructure. Therefore, its backend does not fall within the authorised scope.
Step 2 – Apply the authorisation-boundary principle
A client can only authorise testing of systems it owns or controls. Corvane’s authorisation cannot provide legal permission to test infrastructure belonging to TrueClaim Systems Ltd. Testing that backend would require separate and specific authorisation from the party entitled to grant it.
Step 3 – Assess the IT manager’s email
The email does not resolve the authorisation problem. The IT manager is not identified as a Control Group member or as someone authorised to expand the engagement scope. Furthermore, even an appropriately authorised Corvane employee could not grant permission to test infrastructure that Corvane itself does not own or control.
Step 4 – Do not test TrueClaim’s backend
The team should explain the authorisation issue and escalate the request through the agreed Control Group governance channel. If testing of the backend is genuinely required, appropriate consent from TrueClaim Systems Ltd would need to be obtained and documented before testing begins.
Step 5 – Handle the personal Gmail discovery appropriately
The Gmail account is a personal account and is not owned or controlled by Corvane. The red team should therefore not access, exploit, or further investigate the account itself. However, using a personal account to receive sensitive corporate documents represents a relevant control and data-handling weakness.
Step 6 – Report the Gmail issue
The Control Group should be informed that sensitive information appears to be handled through an unauthorised personal account. Only the minimum information necessary to support the finding should be retained and reported.
Step 7 – Address the governance issue
The Control Group should be informed that a person outside the agreed governance structure attempted to direct testing and expand the scope informally. This indicates that engagement boundaries and authorised communication channels may not be sufficiently understood.
Conclusion
The team should not test TrueClaim Systems Ltd’s backend without separate valid authorisation. The personal Gmail account should not be accessed or exploited, although its use should be reported as a control weakness. The IT manager’s request should be escalated to the Control Group and handled through the established scope and governance process.
Mullins P. –
CertsLand.com provided me with exceptional CREST CCRTM exam preparation services and material. Their study material was comprehensive and helped me achieve an outstanding result on my CREST exam.
David X. –
CREST CCRTM exam dumps offer an effective combination of theory and practice, providing the ideal exam preparation.
Howard P. –
The CREST certification exam is a quite difficult exam to pass
Johnson R. –
CertsLand’s CREST CCRTM exam preparation material was truly life-changing! It sharpened my skills, strengthened my confidence, and led to a successful [certification] outcome.
Jacob A. –
CertsLand.com provided me with invaluable CREST CCRTM exam dumps that enabled me to pass my exam with flying colors! Their comprehensive content made all the difference for my success! I can only give them my thanks and wish them continued success in their mission of providing excellent CREST Certified Red Team Manager – Scenario education materials!
Jesse C. –
CertsLand.com provided me with excellent CREST CCRTM exam preparation material, giving me the confidence to pass my CREST Certified Red Team Manager – Scenario exam.
Earl J. –
CertsLand was an invaluable help during my CREST CCRTM exam preparations. Their study material is thorough, making me confident I would pass.
Roger S. –
CertsLand.com’s CREST CCRTM exam preparation material is an exceptional masterpiece, boasting unsurpassed attention to detail and depth of coverage – an absolute necessity for exam takers!
Adam K. –
Thanks to this dump. I passed the CREST yesterday. It is highly recommended as they proved their success guarantee. Their preparatory CREST CCRTM questions are approved by the professionals and updated in context.
Phillip X. –
CertsLand was invaluable in helping me pass my CREST CCRTM exam effortlessly; their CREST study material covers everything you need to know for an excellent test experience.
Todd K. –
CertsLand was instrumental in my success, and their CREST CCRTM study material is second to none – I wouldn’t have passed my CREST Certified Red Team Manager – Scenario exam without their help!
Dale H. –
Very valid CREST CCRTM dumps. I passed my exam and get 80% of the full score. I use only these CREST CCRTM questions to prepare my [dumps_examanem] exam and passed it successfully.