A security team needs to demonstrate how prepared the team is in the event of a cyberattack. Which of the following would best demonstrate a real-world incident without impacting operations?

The correct answer is B. Gather all internal incident response party members and perform a simulation. A simulation exercise is the best way to test the team's preparedness and response capabilities in a controlled environment. It allows the team to practice: Communication and coordination: How well team members work together Incident handling procedures: Following established…

Submitted by eva_at· Mar 6, 2026Incident Response and Management

Question

Options

AReview lessons-learned documentation and create a playbook.
BGather all internal incident response party members and perform a simulation.
CDeploy known malware and document the remediation process.
DSchedule a system recovery to the DR site for a few applications.

How the community answered

(39 responses)

A
8% (3)
B
74% (29)
C
15% (6)
D
3% (1)

Explanation

A simulation exercise is the best way to test the team's preparedness and response capabilities in a controlled environment. It allows the team to practice: Communication and coordination: How well team members work together Incident handling procedures: Following established protocols Decision-making: Making timely and effective decisions under pressure Tool usage: Effectively utilizing security tools and technologies Incident documentation: Recording actions and lessons learned

Topics

#incident response exercise#simulation#preparedness#cyberattack readiness

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice