Compare red-team and blue-team activities within integrated defense exercises and give an example of a metric to evaluate them.

• A. Red-team simulates defender actions; blue-team attacks; metric: time to recover
• B. Red-team simulates adversary actions; blue-team defends and recovers; metric: time to detect, time to contain, and time to recover
• C. Red-team writes policy; blue-team audits training; metric: incident frequency
• D. Red-team and blue-team are the same

Answer: (B)

The key idea is that red-team versus blue-team exercises are about simulating an attacker’s actions and the defender’s response, then measuring how effectively the defense detects, contains, and recovers from the incident. In this setup, the red team plays the adversary, trying to breach and persist, while the blue team defends, detects the intrusion, contains the impact, and works to restore normal operations.

A good metric mirrors the entire incident lifecycle: time to detect, time to contain, and time to recover. Tracking these three times together shows not just how quickly faults are fixed, but how rapidly anomalies are noticed, how effectively the response contains the spread, and how fast services are restored. This provides a holistic view of defense readiness across detection, containment, and recovery phases.

The other options don’t fit as well. Inverting the roles would misrepresent who is acting as the attacker and defender. Focusing only on time to recover neglects how quickly the team detects and contains the incident. Red-team behavior isn’t about policy writing and audits, and the two teams are not the same—they have distinct roles in testing and defense.