Which statement best describes the roles of red team, blue team, and purple team in security testing?

• A. Red team focuses on defensive monitoring; Blue team simulates attackers; Purple team coordinates.
• B. Purple team coordinates and improves collaboration between red and blue teams.
• C. Red team simulates attacker behavior; Blue team defends and detects; Purple team coordinates and improves detection and response.
• D. Blue team audits compliance and governance.

Answer: (C)

In security testing, attacker emulation (red team) challenges defenses by trying to breach systems, while defenders (blue team) focus on preventing, detecting, and responding to those actions. The purple team acts as the integrator, coordinating between red and blue to turn attacker insights into improvements in detection and response. This collaboration helps ensure that what red teams discover actually strengthens defenses and reduces gaps.

So the statement that best captures this is: red team simulates attacker behavior, blue team defends and detects, and purple team coordinates and improves detection and response. The other options mix up roles (red team as defenders, blue team as attackers) or omit the essential collaboration and improvement aspect that purple teams bring, or misstate responsibilities like compliance auditing for the blue team.