ISC2 Certified in Cybersecurity (CC)Business Continuity (BC), Disaster Recovery (DR) & Incident Response (IR) ConceptsEasy
A cybersecurity team is conducting a tabletop exercise for their incident response plan. What is the primary purpose of this type of exercise?
- ATo perform a full system restore from backups to validate RTO.
- BTo physically relocate personnel to an alternate recovery site.
- CTo test the functionality of redundant hardware and network components.
- DTo review and discuss the plan's effectiveness in a simulated scenario.
Show answer & explanationAnswer & explanation
Correct answer: D. To review and discuss the plan's effectiveness in a simulated scenario.
Tabletop exercises are discussion-based sessions where participants talk through their roles and responsibilities during a simulated incident, identifying gaps and improving the plan without actual system execution.
Why the other options are wrong
- A. This describes a full-scale restoration test, not a tabletop exercise.
- B. This describes a full-scale disaster recovery drill, not a tabletop exercise.
- C. This describes a component test, which is more technical and hands-on than a tabletop exercise.
Tabletop Exercise
A discussion-based exercise that involves key personnel meeting in a conference room setting to discuss their roles and responsibilities during an emergency and how they would respond to a particular incident scenario.
- Low cost and low impact.
- Identifies gaps, misunderstandings, and weaknesses in plans.
- Does not involve actual system or facility activation.
Memory trick: Tabletop: Talking Through The Plan.