Which of the following objectives is best achieved by a tabletop exercise?

Question

Options

• AFamiliarizing participants with the incident response process
• BDeciding red and blue team rules of engagement
• CQuickly determining the impact of an actual security breach
• DConducting multiple security investigations in parallel

• A
  86% (19)
• B
  9% (2)
• D
  5% (1)

Explanation

Tabletop exercises are discussion-based simulations where participants walk through hypothetical scenarios to practice and familiarize themselves with the incident response process - making A correct. They are low-stakes, collaborative learning events focused on reviewing procedures, identifying gaps, and building team awareness, not real-time operational response.

• B is wrong because rules of engagement for red/blue team exercises are defined during planning, not during a tabletop - that's a pre-engagement activity.
• C is wrong because tabletops are simulated, not live; they cannot determine the impact of an actual breach - that requires real incident response tools and investigation.
• D is wrong because tabletops are typically single-scenario, discussion-driven events - running parallel investigations describes an operational SOC workflow, not a tabletop.

Memory tip: Think of a tabletop as a "rehearsal dinner, not the wedding" - it's about learning the process in a safe, no-pressure setting before a real incident occurs.

No community discussion yet for this question.