Purple Team Interview Questions

During a phishing campaign tabletop exercise, you need to explore both offensive and defensive perspectives. What key questions would you ask to engage both red and blue team participants?

Your SOC deployed a new detection rule for Kerberoasting after reading about the technique. They tested it by searching historical logs and found no hits, so they assume it works. You want to validate the detection actually catches real Kerberoasting activity. Walk through how you would test this detection rule in a safe, repeatable way.

Design a purple team exercise to test detection of a full attack chain from initial access to data exfiltration.