Incident Response Exercises and Tabletops

5 minutes 5 Questions

Test mode:
Start practice test

CC - Incident Response Exercises and Tabletops Example Questions

Test your knowledge of Incident Response Exercises and Tabletops

Question 1

Which document provides the authoritative procedures that personnel follow and test during a simulated security event discussion?

Correct Answer: The established organizational incident response plan

The established organizational incident response plan provides the formal, authoritative procedures and guidelines that personnel use to respond to security events, which are actively tested during tabletop exercises.

The finalized technical vulnerability assessment report identifies system weaknesses rather than response procedures, the enterprise physical security baseline configuration dictates facility controls instead of incident handling steps, and the comprehensive employee security awareness training log tracks education completion rather than actionable event response protocols.

Key concept tested: Purpose of an incident response plan during security exercises.

Question 2

Which statement best characterizes the operational impact of conducting an incident response tabletop exercise on production systems?

Correct Answer: It relies on guided, theoretical discussions that pose zero risk to active production environments.

A tabletop exercise is a discussion-based session where team members walk through simulated scenarios, meaning it is purely theoretical and has absolutely no operational impact or risk to live production systems.
Scheduled downtime is incorrect because tabletops do not interact with live systems, active vulnerability scanning describes a technical assessment rather than a discussion, and controlled payload executions describe penetration testing rather than a tabletop exercise.
The key concept tested is the defining characteristics and operational impact of incident response tabletop exercises.

Question 3

Which statement accurately describes the standard operational environment utilized during an incident response tabletop exercise?

Correct Answer: It relies on a discussion-based format within a standard meeting space rather than active manipulation of systems.

The correct answer is right because tabletop exercises are fundamentally administrative, discussion-based walkthroughs of incident response procedures that are conducted in a standard meeting space rather than involving the active manipulation of actual IT systems.
Requiring a complete, isolated replica network to safely execute malware describes a full-scale simulation or cyber range environment. Actively reconfiguring live network firewalls and access controls describes a functional drill or a real-world incident response. Deploying automated utilities to identify and exploit weaknesses describes a penetration test rather than a procedural walkthrough.
The key concept tested is the different methods of incident response plan testing.

More Incident Response Exercises and Tabletops questions
42 questions (total)
Start 42 question test

Other Domain 5: Security Operations and Incident Response concepts

Acceptable Use and BYOD PoliciesAsset Lifecycle Management and EOLAsymmetric EncryptionChange Management PolicyConfiguration Management and Patch ManagementData Classification and LabelingData Destruction and SanitizationData Handling and Retention PoliciesHashing AlgorithmsIncident Containment and EradicationIncident Detection and ReportingIncident Response LifecycleIncident Response PlanningLessons Learned and Post-Incident ReviewPassword Policies and Best PracticesPrivacy Policy FundamentalsQuantum-Resistant Cryptography ConceptsSecurity Event Logging and MonitoringSecurity Event Triage and PrioritizationSecurity Testing: Red, Blue, and Purple TeamingSymmetric EncryptionSystem Hardening and BaselinesThreat Actors and Cyber Threat IntelligenceThreat Frameworks (MITRE ATT&CK, Cyber Kill Chain)
All Domain 5: Security Operations and Incident Response questions · CC practice test