Which of the following BEST facilitates effective incident response testing?

While including all business units is beneficial for awareness, it doesn't, by itself, guarantee the effectiveness or realism of the test scenarios.

Testing after major business changes is a good practice for timing, but it doesn't define the quality or effectiveness of the test itself.

Simulating realistic test scenarios is crucial because it allows the organization to validate its incident response plan and team's capabilities against plausible threats, identifying gaps and weaknesses that might not be apparent in theoretical reviews or less challenging exercises. This hands-on practice under pressure helps ensure the team can perform effectively during an actual incident.

Reviewing test results quarterly is a good practice for continuous improvement, but it doesn't directly facilitate the initial effectiveness of the testing process itself.