Post-incident reviews show that executives were slow to approve containment trade-offs and public statements during recent incidents. They have never taken part in an exercise. Which activity would BEST address this?

The deficiency identified is in leadership decision-making and communication, not in technical execution. An executive tabletop exercise presents a realistic scenario and requires senior leaders to make the decisions they will face in a real incident: approving containment actions that affect revenue or operations, deciding when and how to notify regulators and customers, and authorizing public statements with legal and communications advisers. It builds familiarity with the plan's escalation criteria and decision authority and exposes where roles or information flows are unclear. A technical simulation for the security operations team exercises detection and response skills that were not the problem, and executives would not take part in a meaningful way. A full interruption test focuses on technical failover, imposes disruption and cost, and again does not rehearse executive decisions. A checklist review confirming contact lists may catch outdated details, but executives already received escalations; the delay was in deciding, not in being reached. Exam caveat: match the test type to the capability that failed; leadership gaps call for scenario-based exercises with decision makers present. Operational check: confirm the exercise objectives include decision timeliness and that each executive's role and authority is stated in the plan.