What is the purpose of incident response playbooks, and how do they differ from tabletop exercises?

• A. Playbooks codify repeatable detection/response steps; tabletop exercises validate readiness.
• B. Tabletop exercises validate readiness and decision-making, often testing playbooks; playbooks codify repeatable detection/response steps.
• C. Playbooks are for incident reporting; tabletop exercises replace real drills.
• D. Playbooks document past incidents; tabletop exercises create new playbooks.

Answer: (B)

Incident response playbooks are the documented, repeatable steps that guide responders during an incident. They lay out who does what, when to escalate, what data to collect, what tools to use, and how to communicate with stakeholders, ensuring a consistent, prescriptive approach to detection, containment, eradication, and recovery.

Tabletop exercises, on the other hand, are discussion-based drills that simulate a realistic incident to validate readiness and decision-making. They don’t require live changes in production; instead, participants talk through actions, roles, and escalation paths to see how well the team coordinates and makes timely, appropriate decisions. They also reveal gaps in procedures or approvals and show whether the playbooks themselves are complete or need updates.

The best choice captures both aspects: playbooks codify repeatable detection and response steps, while tabletop exercises validate readiness and decision-making and often test the playbooks themselves.