A municipality is launching a new online payments portal and wants an exercise that both attacks and improves detection simultaneously. Which team model best fits that goal?
Select an answer to reveal the explanation.
Short Explanation
When you want punches and better shields at the same time, purple is the gym partner—attackers and defenders work the same play. Red-only, blue-only, or sealed-off silos miss that joint learning.
Full Explanation
Purple team collaboration deliberately couples offensive techniques with defensive observation so detections improve during the same engagement. For a new municipal online payments portal, that model lets red-side operators execute realistic payment-fraud and account-takeover techniques while blue-side analysts tune SIEM rules, use cases, and response playbooks in iterative loops. The goal is simultaneous attack validation and detection improvement—exactly what purple teaming is designed to deliver—rather than a one-way finding dump or a defender-only tuning exercise without adversarial pressure.
Red team only finds exploitable paths and report-worthy breakthroughs but does not optimize monitoring during the exercise; findings may arrive too late for detection engineering that should occur while techniques are fresh. Blue team only can refine rules against synthetic or historical data, yet without live adversarial pressure those rules may never face novel chaining, living-off-the-land paths, or portal-specific abuse. Separate red and blue teams that never share notes recreate classic silos: attackers finish, defenders guess, and learning transfer is minimized precisely when the municipality wants both punches and better shields.
Exam caveat: CISSP assessment topics contrast red, blue, and purple models. When the stem asks for attack and detection improvement together, purple is the intended answer. Purple is not ‘weaker red’; it is a collaboration pattern with shared objectives and rapid feedback.
Operational check: Define purple rules of engagement for the payments portal (in-scope accounts, rate limits, no destructive payment settlement), instrument detections before the exercise, run short attack–detect–tune cycles, capture which techniques were seen versus missed, and produce a joint after-action that maps missed techniques to new use cases before go-live.