What is the purpose of tabletop exercises in incident response planning?

• A. To replace live drills
• B. To evaluate budgets
• C. To practice coordination and decision-making, identify gaps, and improve readiness without real incidents
• D. To train new hires in security software

Answer: (C)

Tabletop exercises are discussion-based simulations that bring the incident response team together to walk through how they would recognize and respond to a hypothetical security incident. The main value is practicing coordination and decision-making across roles and functions, plus the ability to test how information flows and who makes what decisions under pressure—without risking real systems. They also reveal gaps in the incident response plan, such as missing contact lists, unclear escalation paths, or dependencies on specific tools, so you can tighten procedures and update playbooks before an actual incident occurs. Because they’re low-risk and low-cost, they’re ideal for improving readiness and refining the overall incident response approach.

This is the best fit because it explicitly centers on coordinating actions, making timely decisions, and identifying and closing gaps without real incidents. They’re not meant to replace live drills, they aren’t primarily about budgeting, and they aren’t focused on training new hires in security software.