Asimulation(such as atabletop exercise or full-scale IR drill) is the best way to demonstrate real-world readiness without affecting operations.
* Option A (Reviewing lessons-learned and playbooks)is valuable but does not actively test readiness.
* Option C (Deploying malware)is highly risky and unethical in a production environment.
* Option D (Disaster recovery site testing)focuses on DR, not security incident readiness.
Thus,B is the best choice, as simulations effectivelytest incident response capabilities without operational disruption.