What best defines a tabletop exercise?

• A. A live-fire technical drill.
• B. A formal compliance audit.
• C. A discussion-based drill where participants walk through a hypothetical incident to test plans and coordination.
• D. A software vulnerability scan.

Answer: (C)

Tabletop exercises test how well a response plan works in practice by focusing on discussion and decision-making rather than hands-on actions. In this format, participants gather to walk through a hypothetical incident step by step, reviewing roles, responsibilities, communications, and escalation paths to see how the plan would actually unfold in real life. The emphasis is on cognitive coordination, problem-solving, and time-sensitive decisions in a safe, low-risk setting, which helps uncover gaps without the need to perform any physical or technical operations.

This differs from a live-fire drill, which involves executing real-world, hands-on actions that can be physically demanding and potentially dangerous. It also differs from a formal compliance audit, which concentrates on reviewing documentation and adherence to standards rather than practicing how to respond. And it’s not a software vulnerability scan, which is a technical assessment aimed at identifying weaknesses in systems rather than practicing how an organization would respond to an incident.