A water-utility purple team uses multi-agent roles (recon, persistence, detect-check) for offensive simulation, but only inside an isolated cyber range. What practice does that reflect?
Select an answer to reveal the explanation.
Short Explanation
Multi-agent recon, persistence, and detect-check roles are fine as long as they stay inside the fenced cyber range, not loose on live OT. Isolation is the whole safety boundary here. You'll miss the purple exercise if you're on live production OT networks, you're doing annual access recertification, or you're doing red-only exploitation for access validation without detect-check teamwork.
Full Explanation
Water-utility purple teams that use multi-agent roles (recon, persistence, detect-check) only inside an isolated cyber range are applying multi-agent offensive simulation under containment. Role specialization can realistically exercise collaboration patterns, but isolation keeps those patterns off live production OT networks where process impact is unacceptable. The range is the civic safety boundary that makes advanced agentic simulation permissible.
The correct practice works because capability and placement are both required for safety. Multi-agent realism without isolation is reckless; isolation without structured roles may under-test detection collaboration. Together they support utility purple objectives.
Applying multi-agent offensive simulation inside isolated civic ranges for annual access recertification with purple teams fails to match the stem: annual access recertification reviews user entitlements for governance, not the live multi-agent recon/persistence/detect-check offensive simulation the exercise describes.
Applying multi-agent offensive simulation inside isolated civic ranges using red-only exploitation for access validation fails because red-only exploitation for access checks lacks purple detect-check collaboration, not the technical recon, persistence, and detect-check agent roles actually running the offensive simulation.
Applying multi-agent offensive simulation on live production OT networks rather than inside isolated civic ranges fails because it places recon, persistence, and detect-check agents on live OT where process impact is unacceptable, not the contained isolated-range simulation the exercise describes.
Exam caveat: Multi-agent offensive simulation belongs in isolated civic ranges—not live production OT networks, annual access recertification, or red-only exploitation for access validation standing in for the real exercise.
Operational check: Verify network isolation controls (no routes to OT/business LAN), test that agents cannot pivot out, and keep role orchestration credentials range-scoped only.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.