An information security manager is updating the organization's incident response plan. Which of the following is the BEST way to validate that the process and procedures provided by IT and business un

Question

Options

• AReview data breach incident triage steps.
• BReview the test objectives with stakeholders.
• CConduct an incident response plan survey.
• DConduct a data breach incident tabletop exercise.

• A
  14% (4)
• B
  4% (1)
• C
  7% (2)
• D
  75% (21)

Explanation

Conducting a tabletop exercise (D) is the best validation method because it actively tests whether procedures are complete, accurate, and understood by all responsible teams - simulating a real incident scenario forces participants to walk through their roles, exposing gaps in process, knowledge, or coordination that a document review would miss.

Why the distractors fall short:

• A (Review triage steps) - Reviewing documentation only confirms what's written down, not whether it's accurate or whether teams actually know it.
• B (Review test objectives with stakeholders) - This is preparatory work, not validation; agreeing on what to test is not the same as testing it.
• C (Conduct a survey) - A survey measures self-reported awareness, which is unreliable; people may believe they know procedures without actually being able to execute them.

Memory tip: Think of "validate" as requiring active demonstration, not passive review. Whenever an exam question asks how to confirm that people know and can execute a process, tabletop exercises win because they prove readiness through simulated practice - surveys and document reviews only prove awareness at best.

No community discussion yet for this question.