CC: Security Testing: Red, Blue, and Purple Teaming

Question 1

What is the shared knowledge base created when offensive and defensive teams collaborate to improve detection during a security readiness exercise?

A record of attack methods paired with matching detection rules A summary of business risks ranked by financial loss impact A schedule that assigns rotating shifts among monitoring analysts A catalog of software versions approaching their end-of-life date

Correct Answer: A record of attack methods paired with matching detection rules

When offensive (red) and defensive (blue) teams collaborate in a purple team exercise, they build a shared knowledge base that pairs each attack technique with the corresponding detection logic, so gaps in monitoring can be identified and closed.

The business risk summary reflects risk management, not detection improvement. The rotating shift schedule addresses staffing logistics, not attack detection. The end-of-life software catalog relates to patch and asset management, not collaborative detection tuning.

Key concept: purple teaming and mapping adversary techniques to detection coverage.

Question 2

An organization's leaders want to know how well their defensive analysts can spot and respond to simulated attacks during a live engagement. They ask which team is responsible for watching the monitoring systems and reacting to the offensive activity as it happens. Which team fills this role?

The blue team, which monitors alerts and defends against the simulated attacks The red team, which launches the offensive attacks against the target systems The purple team, which coordinates communication between the offensive and defensive groups The white team, which sets the rules of engagement and oversees the entire exercise

Correct Answer: The blue team, which monitors alerts and defends against the simulated attacks

The blue team is the defensive group responsible for monitoring systems, detecting intrusions, and responding to attacks as they occur during an engagement.

The red team is wrong because it performs the offensive attacks rather than defending. The purple team is wrong because it facilitates collaboration and knowledge sharing between offense and defense, not live monitoring. The white team is wrong because it manages the rules of engagement and referees the exercise rather than reacting to attacks.

Key concept tested: the roles of security exercise teams, specifically the blue team's defensive detection and response function.

Question 3

When building a combined offensive and defensive security testing program, which core element defines a purple team design compared with running separate teams?

A continuous feedback loop that shares attack methods and defensive results between both groups A separation of duties policy that keeps attack and defense findings in isolated reports A scoring framework that ranks each team by the number of vulnerabilities they uncover A rotating schedule that alternates offensive and defensive duties among the same staff members

Correct Answer: A continuous feedback loop that shares attack methods and defensive results between both groups

A purple team is defined by collaboration, where a continuous feedback loop lets attackers (red) and defenders (blue) share techniques and results so defenses improve in real time.

The rotating schedule confuses cross-training with the collaborative structure that defines purple teaming. The scoring framework promotes competition rather than integration, which is the opposite goal. The separation of duties option isolates findings, directly contradicting the shared visibility that makes a purple team effective.

Key concept: purple teaming as continuous red and blue collaboration and knowledge sharing.

Security Testing: Red, Blue, and Purple Teaming