What is the key difference between red-teaming and purple-teaming?

• A. Red-teaming simulates attackers; Purple-teaming emphasizes collaboration between blue and red to improve defense.
• B. Purple-teaming simulates attackers; Red-teaming focuses on defense improvements.
• C. Red-teaming is illegal; Purple-teaming is legal only with approvals.
• D. Purple-teaming is used only in development environments.

Answer: (A)

Key idea: red-teaming and purple-teaming differ in whether defense and attack work together. Red-teaming is about simulating real attackers to probe defenses, test detection, and reveal gaps from an adversary’s perspective. It’s an offense-focused exercise aimed at seeing how well the security stack holds up under authentic attack techniques. Purple-teaming, on the other hand, brings blue (defense) and red (attack) teams together in a collaborative effort. They share attacker techniques and defense feedback in real time to rapidly tune detections, responses, and overall security posture.

That’s why the best description is that red-teaming simulates attackers while purple-teaming emphasizes collaboration between blue and red to improve defense. The other statements mix up roles, imply the wrong focus, or assign inappropriate constraints (like illegality or a limitation to development environments), which don’t capture the real distinction.