CompTIA Security+ (SY0-501) — Question 913

A security administrator wants to better prepare the incident response team for possible security events. The IRP has been updated and distributed to incident response team members. Which of the following is the BEST option to fulfill the administrator's objective?

Answer options

• A. Identify the member's roles and responsibilities
• B. Select a backup/failover location
• C. Determine the order of restoration
• D. Conduct a tabletop test

Correct answer: D

Explanation

Conducting a tabletop test allows the incident response team to practice responding to simulated security events, thereby improving their readiness. While identifying roles, selecting backup locations, and determining restoration order are important, they do not provide the hands-on practice that a tabletop exercise offers, which is critical for effective incident response.