The correct answer is A because a tabletop exercise is a low-cost and effective way to assess incident response capabilities. It allows participants to walk through a simulated incident scenario and evaluate roles, responsibilities, escalation paths, communication procedures, decision-making, and coordination without disrupting production systems. A tabletop exercise can identify weaknesses in the incident response plan, improve readiness, and increase participant familiarity with response procedures. Senior management interviews may provide insight into governance awareness, but they do not test operational response capability. Penetration testing can identify vulnerabilities and may trigger response processes, but it is more expensive and focused on technical exposure rather than full incident response capability. A third-party assessment can be valuable, but it is usually more costly than an internal tabletop exercise. CISM incident management emphasizes regular testing, lessons learned, and continuous improvement. Because tabletop exercises provide practical assessment value with relatively low cost and low operational risk, they are the most cost-effective method.
Reference: CISM Information Security Incident Management; incident response testing, tabletop exercises, preparedness, and continuous improvement principles.