nerdexam
(ISC)2

CISSP-ISSAP · Question #240

John works as a security manager for SoftTech Inc. He is working with his team on the disaster recovery management plan. One of his team members has a doubt related to the most cost effective DRP test

The correct answer is C. Structured walk-through test. Structured walk-through testing (also called a tabletop exercise) brings all team members together in a facilitated discussion to verbally walk through each step of the DRP, making it ideal for surfacing overlaps, gaps, and coordination issues at minimal cost - no systems are dis

Architect for Governance, Risk, and Compliance

Question

John works as a security manager for SoftTech Inc. He is working with his team on the disaster recovery management plan. One of his team members has a doubt related to the most cost effective DRP testing plan. According to you, which of the following disaster recovery testing plans is the most cost-effective and efficient way to identify areas of overlap in the plan before conducting more demanding training exercises?

Options

  • AEvacuation drill
  • BWalk-through drill
  • CStructured walk-through test
  • DFull-scale exercise

How the community answered

(18 responses)
  • A
    6% (1)
  • B
    6% (1)
  • C
    72% (13)
  • D
    17% (3)

Explanation

Structured walk-through testing (also called a tabletop exercise) brings all team members together in a facilitated discussion to verbally walk through each step of the DRP, making it ideal for surfacing overlaps, gaps, and coordination issues at minimal cost - no systems are disrupted, no equipment is needed, just people and the plan document. It strikes the right balance between thoroughness and resource investment, which is why it's recommended before escalating to more disruptive exercises.

Why the distractors are wrong:

  • (A) Evacuation drill - focuses on physical building egress and life-safety, not IT/operational recovery procedures; it doesn't test plan overlap.
  • (B) Walk-through drill - typically refers to a less formal, often individual-department review of checklists, lacking the cross-team collaboration needed to reveal overlap between groups.
  • (D) Full-scale exercise - the most realistic but also the most expensive and disruptive test type; it simulates an actual disaster with real systems, making it inappropriate as a first-pass overlap check.

Memory tip: Think of the word "structured" as the key - it means all stakeholders sit together in a structured meeting and talk through the plan systematically. No systems touched, no budget burned, but every team's role is cross-examined against every other's. "Structure before stress" - structure the conversation before you stress the infrastructure.

Topics

#Disaster Recovery Testing#Structured Walk-through#Cost-effectiveness#Business Continuity

Community Discussion

No community discussion yet for this question.

Full CISSP-ISSAP Practice