The correct answer is D because an unannounced disaster recovery exercise is primarily intended to evaluate how personnel respond under realistic and unexpected conditions. Unlike scheduled exercises, unannounced tests help determine whether staff understand their roles, follow procedures, communicate effectively, and make appropriate decisions when there is no advance preparation. This type of exercise can reveal weaknesses in readiness, escalation, coordination, and practical response behavior. Assessing service level agreements may be a secondary benefit, but it is not the main purpose of an unannounced exercise. Providing metrics to senior management is useful for reporting, but metrics are an output of the exercise, not the primary objective.
Estimating the recovery time objective is incorrect because the RTO should already be established through business impact analysis and business requirements; testing helps validate whether the RTO can be met. In CISM practice, disaster recovery and incident exercises are used to validate preparedness, response capability, and organizational resilience.
Reference: CISM Information Security Incident Management; disaster recovery testing, response preparedness, business continuity, and exercise management principles.