Sample questions
Pt Red Team Engagement ManagementDifficulty 1
A client asks a security firm to test whether their detection and response team can spot and stop a simulated intrusion, rather than asking for a full list of every vulnerability in their systems. Which type of engagement best matches this request?
- aA red team engagement, because its goal is to test detection and response capability through a realistic, objective-driven simulation rather than to enumerate every flaw.✓
- bA vulnerability scan, because it produces the broadest list of known weaknesses in the shortest time, even though it does not simulate a stealthy adversary or reveal whether the operations team would actually notice a real, ongoing intrusion.
- cA compliance audit, because auditors are responsible for verifying that a detection team exists on paper.
- dA code review, because static analysis of source code is the only way to measure how a SOC responds to an intrusion.
Explanation:Red teaming is objective-driven and stealthy: it measures whether real defenses (people, process, and tooling) detect and respond to realistic attacker behavior, unlike a scan or a broad vulnerability assessment that aims for coverage of known weaknesses.
Pt Red Team Engagement ManagementDifficulty 1
In a purple team exercise, the offensive (red) side and the defensive (blue) side work together in real time, sharing what actions were taken and what was or was not detected as the exercise progresses. What is the primary purpose of this collaborative format?
- aTo let the red team skip authorization paperwork, since blue team members already know an exercise is happening.
- bTo replace the need for a written report at the end of the engagement, since everything is discussed live instead, even though most organizations still need a written record for audit trails, remediation tracking, and stakeholders absent from the live sessions.
- cTo guarantee that no vulnerabilities remain, since collaboration between the two teams eliminates all security weaknesses.
- dTo accelerate the blue team's learning by giving immediate feedback on detection gaps, so defenses improve faster than a traditional after-the-fact report would allow.✓
Explanation:Purple teaming's value is the tight feedback loop: instead of waiting weeks for a report, defenders learn in near-real-time which of their controls fired, which stayed silent, and why, which speeds up tuning of detections and playbooks.
Pt Red Team Engagement ManagementDifficulty 1
During a red team engagement, only a small, trusted group of people at the client (often called the white cell or control group) knows the exercise is happening, while the rest of the security operations team is kept unaware. What is this practice called, and why does it matter?
- aIt is called a compliance waiver, and it matters because it legally excuses the red team from needing any signed authorization.
- bIt is part of a 'no-notice' or blind test design, and it matters because it lets the client honestly measure how their operations team reacts to an unannounced intrusion, without the results being skewed by advance knowledge.✓
- cIt is called a scope violation, and it matters because keeping the operations team unaware is against best practice and should always be avoided, even though in reality no-notice testing is a deliberate, widely recommended design choice precisely because it prevents rehearsed behavior from masking real detection gaps.
- dIt is called a vulnerability disclosure, and it matters because it determines how a discovered bug gets reported to a vendor.
Explanation:Blind or 'no-notice' testing intentionally limits advance knowledge to a small control group so the exercise measures genuine detection and response behavior instead of behavior that has been rehearsed because staff knew a test was coming.
Pt Red Team Engagement ManagementDifficulty 1
A red team lead is planning an adversary emulation exercise and wants to base the simulated attacker's behavior on a publicly documented, structured knowledge base of real-world tactics and techniques. Which type of resource is being referred to at this planning level?
- aA CVE database, since it lists specific software vulnerabilities rather than attacker behavior patterns, and therefore cannot describe the sequence of tactics and procedures needed to emulate a real-world adversary's overall campaign.
- bA password cracking wordlist, since it is a structured collection used during planning.
- cA company's internal HR directory, since it documents roles rather than adversary behavior.
- dA framework such as MITRE ATT&CK, since it catalogs known adversary tactics and techniques and is commonly used to select a realistic scenario matching an organization's actual threat profile.✓
Explanation:At the planning level, adversary emulation typically references a tactics-and-techniques knowledge base (most commonly MITRE ATT&CK) to choose which real-world adversary behaviors to model, matched against threat intelligence about who is likely to target the organization.
Pt Red Team Engagement ManagementDifficulty 1
What is the main functional difference between a traditional penetration test and a red team engagement, from a management perspective?
- aA penetration test always costs more money because it requires a larger team of testers than a red team engagement.
- bThere is no real difference; the two terms are used interchangeably by every organization and framework, so scoping conversations never need to clarify which type of engagement is actually being requested, which deliverable will be produced, or how success will be measured at the end.
- cA penetration test typically aims for broad coverage of vulnerabilities within a defined scope in a limited time, while a red team engagement pursues specific objectives stealthily to test detection and response.✓
- dA penetration test is always performed by an internal team, while a red team engagement is always outsourced to an external vendor.
Explanation:Management-level distinction: pentests generally optimize for coverage (finding as many vulnerabilities as possible in scope), while red team engagements optimize for realism and stealth against specific goals, measuring the organization's ability to detect and respond.
Pt Red Team Engagement ManagementDifficulty 2
Why does a red team engagement typically need an explicit 'deconfliction' process with the client's security operations center (SOC), separate from the general rules of engagement document?
- aSo that if the SOC detects suspicious activity mid-exercise, a trusted contact can quickly confirm whether it is the red team's simulated activity or a real, unrelated attacker, avoiding wasted incident response effort or a missed real intrusion.✓
- bSo that the red team can bill extra hours for the additional paperwork involved in writing the process, which has nothing to do with distinguishing simulated activity from a genuine intruder during the live exercise window, and does not protect the SOC from wasting effort on a false alarm.
- cSo that the SOC can cancel the engagement at any time without needing a documented reason.
- dSo that the client's legal team can avoid reviewing the rules of engagement altogether.
Explanation:Deconfliction gives the control group a fast, trusted channel to check 'is this us?' when the SOC flags something suspicious, preventing two failure modes: chasing the red team as if it were a real incident, or dismissing a genuine attacker as 'probably the exercise.'