The primary purpose of a tabletop exercise is to prepare the incident response team for a real-world event (C). Tabletop exercises allow participants to walk through scenarios, clarify roles and responsibilities, validate decision-making, and identify gaps in procedures—without the disruption of a live incident. While outcomes may inform resource needs (A), program maturity (B), or leadership reporting (D), these are secondary benefits. CISM emphasizes regular testing of incident response capabilities to ensure teams can respond quickly, consistently, and effectively under pressure.
[References: ISACA CISM Review Manual (Incident management—testing, exercises, and readiness); CISM Exam Content Outline (Domain 4)., , , , ]
Submit