Due to a recent breach, the Chief Executive Officer (CEO) has requested the following activities be conducted during incident response planning: - Involve business owners and stakeholders - Create an applicable scenario - Conduct a biannual verbal review of the incident response plan - Report on the lessons learned and gaps identified Which of the following exercises has the CEO requested?

CompTIA

CAS-003 · Question #649

Due to a recent breach, the Chief Executive Officer (CEO) has requested the following activities be conducted during incident response planning: - Involve business owners and stakeholders - Create…

The correct answer is C. Internal review. The activities described - involving business owners, conducting a biannual verbal review of the IR plan, and reporting on lessons learned and gaps - align with an Internal Review. An internal review is a structured, discussion-based examination of an existing plan with…

Enterprise Security Operations

Question

Due to a recent breach, the Chief Executive Officer (CEO) has requested the following activities be conducted during incident response planning:

Involve business owners and stakeholders
Create an applicable scenario
Conduct a biannual verbal review of the incident response plan
Report on the lessons learned and gaps identified

Which of the following exercises has the CEO requested?

Options

AParallel operations
BFull transition
CInternal review
DTabletop
EPartial simulation

How the community answered

(44 responses)

B
2% (1)
C
91% (40)
D
2% (1)
E
5% (2)

Explanation

The activities described - involving business owners, conducting a biannual verbal review of the IR plan, and reporting on lessons learned and gaps - align with an Internal Review. An internal review is a structured, discussion-based examination of an existing plan with relevant internal stakeholders to assess its effectiveness, identify gaps, and capture lessons learned. It does not involve simulating or executing a response in real or parallel systems. While a Tabletop (D) also involves verbal discussion of a scenario, it is focused on walking through a hypothetical incident in real time. The emphasis here on reviewing the plan periodically and reporting gaps - rather than simulating a live incident response - makes Internal Review the best fit. Parallel operations (A) and full transition (B) involve actual system switchovers, and partial simulation (E) involves executing some portions of the response.

Topics

#incident response exercises#tabletop exercise#IR planning#lessons learned

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice