Which practice uses adversarial pressure to reveal vulnerabilities before real operations?

• A. Internal audit reports.
• B. Routine maintenance checks.
• C. Red-teaming.
• D. Public press releases.

Answer: (C)

Red-teaming is the practice that uses adversarial pressure to reveal vulnerabilities before real operations. In a red-team exercise, an independent group plays the role of attackers, attempting to breach defenses, bypass controls, and execute realistic attack scenarios under safe, authorized conditions. The aim is to stress the system the way a real adversary would, forcing defenders to demonstrate detection, incident response, and recovery capabilities and to uncover gaps that could be exploited in a real incident. This proactive, attacker-minded testing surfaces weaknesses that routine checks might miss, enabling improvements before any real harm occurs. Internal audits focus on governance and controls rather than attacker simulations; routine maintenance checks verify ongoing functionality and security of systems; public press releases involve external communications and do not test defenses.