Compare red-team and blue-team activities within integrated defense exercises and give an example of a metric to evaluate them.

• A. Red-team simulates defender actions; blue-team attacks; metric: time to recover
• B. Red-team simulates adversary actions; blue-team defends and recovers; metric: time to detect, time to contain, and time to recover
• C. Red-team writes policy; blue-team audits training; metric: incident frequency
• D. Red-team and blue-team are the same

Answer: (B)