A simulation test presents a specific disaster scenario to the incident-response and recovery team, who then “role-play” their actions step-by-step while seated in a conference-room setting. The goal is to discuss the scenario, validate that each participant knows the proper response, and reveal gaps in procedures—exactly the task described in the question. No production systems are interrupted; the exercise is discussion-based but driven by the simulated event rather than a simple line-by-line review of the plan.

A. Full-interruption test ‒ Actually shuts down live operations and transfers processing, not a discussion exercise.

B. Parallel test ‒ Runs systems at an alternate site in parallel with production to verify processing; involves technical processing, not tabletop discussion.

D. Structured walk-through test ‒ Team reviews the plan line-by-line without a detailed scenario; focuses on documentation accuracy rather than eliciting response actions to a simulated event.

1. (ISC)² CISSP Official CBK

5th ed.

Domain 7 “Security Operations”

Disaster-Recovery Testing

Simulation Test description

pp. 394-395.

2. (ISC)² CISSP Official Study Guide

9th ed.

§21.5.3 “Simulation (Table-Top) Test”

p. 979.

3. NIST Special Publication 800-84

“Guide to Test

Training

and Exercise Programs”

§2.3.2 Tabletop/Simulation Exercises

pp. 2-9 – 2-10.

4. Stanford Univ. CS Department course notes “CS 155 – Cybersecurity: Incident Response & DR”

Lecture 18 slides 17-18 (Simulation/table-top definition).