Which of the following provides an information security manager with the MOST accurate indication of the organization's ability to respond to a cyber attack?

A red team exercise provides the most accurate and comprehensive indication of an organization's ability to respond to a cyber attack. Unlike standard penetration tests that primarily focus on identifying technical vulnerabilities, red teaming simulates real-world, multi-vector adversarial tactics, techniques, and procedures (TTPs) over an extended period. This holistic approach rigorously tests the organization's entire defensive posture, including the effectiveness of its detection mechanisms, the readiness of the incident response team (Blue Team), and the robustness of established security procedures. By mimicking a genuine threat actor, it reveals practical gaps in the organization's detection and response capabilities under realistic operational conditions.

A. A walk-through is a theoretical tabletop exercise that discusses procedures but does not test actual operational detection and response capabilities under pressure.
B. A black box penetration test focuses on identifying and exploiting technical vulnerabilities rather than comprehensively evaluating the organization's incident response processes.
C. A simulated phishing exercise only tests end-user awareness and email security controls, not the comprehensive incident response capabilities of the security team.

1. ISACA CISM Review Manual, 15th Edition, Chapter 4 (Information Security Incident Management).

2. NIST Special Publication 800-115, Technical Guide to Information Security Testing and Assessment, Section 2.4 (Red Team Exercises).