change evaluate_defense, add tests

Avoid counting the ? in (?...) twice.