When testing incident response tabletop exercises for effectiveness, which activity best demonstrates preparedness?

• A. Document and review the exercise without metrics.
• B. Define scenarios, assign roles, measure detection, containment, recovery times, and improvement actions; evaluate communications and RCA quality.
• C. Randomly assign roles without predefined scenarios.
• D. Focus only on the speed of answering questions.

Answer: (D)