N10-009 Question 223
Select 2Testing: Tabletop exercises, Validation testsA network administrator is helping prepare the organization for a possible ransomware incident that could disrupt core network services. Management wants to first walk through how the IT, security, and operations teams would respond without affecting production systems. After that, they want to confirm that documented recovery steps for restoring DNS and DHCP services from backups actually work in a controlled environment. Which TWO testing approaches should the administrator recommend?
- A
Conduct a tabletop exercise for the incident response teams, then perform a validation test of DNS and DHCP recovery procedures in a non-production environment.
- B
Run a full failover of production DNS and DHCP during business hours, then ask each team to review what happened afterward.
- C
Distribute the incident response plan by email and require staff to acknowledge receipt as proof that the response process and recovery procedures are effective.
- D
Hold a tabletop exercise to discuss the ransomware scenario, then rely on the most recent backup job status to confirm service restoration will succeed.
- E
Perform a validation test by restoring DNS and DHCP from backup in a test environment, and use a tabletop exercise to verify communication paths, decision points, and team responsibilities.
Show answer and explanation
Correct answers: A, E
Explanation
The best answer is to use both a tabletop exercise and a validation test. In practice, these methods serve different but complementary purposes. A tabletop exercise is discussion-based and is commonly used to review incident response procedures, communication flows, escalation criteria, and participant responsibilities without making changes to production systems. A validation test is used to confirm that technical controls or recovery procedures actually work, such as restoring DNS and DHCP from backup in a lab or non-production environment.
This distinction aligns with common business continuity, disaster recovery, and incident response best practices. Industry guidance such as NIST incident response and contingency planning publications emphasizes exercising plans and validating recovery capabilities rather than assuming documentation or backup success equals operational readiness. In a Network+ context, candidates should recognize that reviewing a plan is not enough, and that backup completion alone does not prove recoverability. The realistic, low-risk approach is to use a tabletop exercise for coordination and a validation test for technical recovery verification.
- A. Correct.
Correct. A tabletop exercise is a discussion-based review of roles, decisions, escalation paths, and response actions during a simulated event. It is designed to test coordination and understanding without touching production systems. A validation test then confirms that documented technical recovery procedures, such as restoring DNS and DHCP from backup, actually function as expected in a controlled environment. This pairing directly matches management's two stated goals.
- B. Incorrect.
Incorrect. Executing a full production failover during business hours is unnecessarily disruptive and risky for an initial planning and preparedness effort. It is closer to a live operational test than a tabletop exercise. While live testing can be appropriate in some mature environments, it does not meet the requirement to first walk through the response without affecting production systems.
- C. Incorrect.
Incorrect. Requiring staff to acknowledge an emailed plan only verifies distribution and receipt, not operational readiness. It does not test whether teams understand their roles, whether escalation paths are clear, or whether technical recovery procedures actually work. This is a common misconception: documentation review is not the same as exercising or validating a plan.
- D. Incorrect.
Incorrect. The tabletop portion is appropriate, but backup job status alone does not validate recoverability. Successful backups do not guarantee that services can be restored correctly, that configuration dependencies are intact, or that restored DNS and DHCP services will function properly. Validation testing requires an actual restore or comparable technical verification in a controlled setting.
- E. Correct.
Correct. This option includes both required elements in the proper context. A validation test is used to verify that technical steps, such as restoring core network services from backup, are successful and repeatable. A tabletop exercise is used to examine the human and procedural side of incident response, including communications, approvals, and team responsibilities. Together they provide both procedural and technical assurance.