Which of the following provides an information security manager with the MOST accurate indication of the organization's ability to respond to a cyber…

A red team exercise provides the most accurate indication of an organization's ability to respond to a cyber attack. It is a full-scope, objective-based adversarial simulation that mimics the tactics, techniques, and procedures (TTPs) of real-world attackers. This type of exercise tests the entire security program, including the effectiveness of the incident response team (the "blue team"), their processes, and the deployed technologies in a realistic, live environment. It moves beyond theoretical evaluation to a practical assessment of detection, response, and coordination capabilities under the pressure of a simulated attack, providing the most comprehensive and accurate feedback.

A. A walk-through is a discussion-based (tabletop) exercise that reviews the plan's content and roles but does not practically test the team's ability to execute it under pressure.

B. A black box penetration test primarily focuses on identifying technical vulnerabilities from an external perspective, not on evaluating the organization's coordinated incident response process.

C. A simulated phishing exercise is a narrow test focused on a single attack vector and user awareness, not the organization's overall capability to respond to a complex cyber attack.

1. ISACA

CISM Review Manual

16th Edition. Domain 4: Information Security Incident Management

Section 4.7

"Testing the Incident Response Plan." The manual describes a continuum of testing methods

from basic plan reviews to full-scale simulations. It emphasizes that simulations

such as red team exercises

provide the highest level of assurance by testing the plan and response capabilities in a realistic

simulated environment.

2. National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-84

Guide to Test

Training

and Exercise Programs for IT Plans and Capabilities. Section 4.3

"Exercises." This guide categorizes exercises by complexity

with full-scale exercises being the most comprehensive. A red team exercise is a type of full-scale exercise that "simulates a real-world event as closely as possible" and is designed to "validate plans and procedures and test the functioning of all response elements."

3. National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations. Control CA-8

"Penetration Testing." The discussion for this control notes that red team exercises are a type of penetration test used to "simulate adversary actions to assess and improve prevention

detection

and response capabilities." This directly links red teaming to the evaluation of response capabilities.