CompTIA Security+ (SY0-501) — Question 218

A security team wants to establish an Incident Response plan. The team has never experienced an incident.
Which of the following would BEST help them establish plans and procedures?

Answer options

• A. Table top exercises
• B. Lessons learned
• C. Escalation procedures
• D. Recovery procedures

Correct answer: A

Explanation

Table top exercises are simulations that allow the team to practice and refine their response to potential incidents in a controlled environment, making them ideal for building plans and procedures from scratch. The other options, while useful in different contexts, do not provide the hands-on practice and scenario-based learning that table top exercises offer.