Before ransomware hits, leadership wants staff to walk through decision-making without taking production systems offline. Which testing type fits?
Select an answer to reveal the explanation.
Short Explanation
A tabletop is the conference-room rehearsal—talk through the ransomware play like a script reading before opening night. You learn who calls whom without yanking production plugs. Jumping straight into live cutovers with no rehearsal is how you discover gaps the hard way.
Full Explanation
A tabletop exercise walks participants through roles, decisions, and communications for a scenario such as ransomware without changing production systems. For municipal incident response, that discussion validates who declares an incident, who talks to executives and the public, how backups are evaluated, and where authority bottlenecks appear—before a real attack forces those choices under pressure.
Immediate production failover that shuts down the primary with no rehearsal turns the first test into a live outage. Jumping solely to a full parallel cutover of every database with live citizen traffic on day one skips cheaper learning cycles and risks data issues. Skipping all exercises because written plans “never need practice” leaves untested assumptions in the plan.
Exam caveat: tabletops, functional exercises, and full cutovers are different maturity levels. Start with discussion-based rehearsal for process clarity; technical failover tests still matter later. Plans without practice are aspirational documents.
Operational check: schedule a ransomware tabletop with IT, legal, public information, and leadership; capture action items on contact trees and decision rights; update the IR plan; then graduate to technical restore tests without making the first rehearsal a blind production shutdown.