CompTIA Security+ (SY0-501) — Question 63

A director of IR is reviewing a report regarding several recent breaches. The director compiles the following statistic's
-Initial IR engagement time frame
-Length of time before an executive management notice went out
-Average IR phase completion
The director wants to use the data to shorten the response time. Which of the following would accomplish this?

Answer options

• A. CSIRT
• B. Containment phase
• C. Escalation notifications
• D. Tabletop exercise

Correct answer: D

Explanation

A tabletop exercise is a simulated scenario where team members can practice their roles in the incident response process, which can help identify inefficiencies and improve response times. The other options, while important, do not directly contribute to shortening response time as effectively as conducting a tabletop exercise would.