Study. uk . com
  1. Home
  2. All questions
  3. Question 96

CompTIA Security+ study material · question 96 of 611

After a successful tabletop exercise, a manager states the recovery capability is now proven. Why is that overstating the result?

  1. A tabletop tests decisions and plans, not whether the technical recovery works
  2. Tabletops must be repeated three times to be valid
  3. Tabletops do not involve the incident response team
  4. Tabletops may only be run by external assessors
Show the answer

Answer: A. A tabletop tests decisions and plans, not whether the technical recovery works

Only a functional drill or full simulation exercises the actual recovery path.

Source: NIST SP 800-34 Rev. 1 (NIST) — SP 800-34 Rev. 1 § 3.5 Plan Testing, Training, and Exercises

Challenge yourself on this topic → Study as cards