During an incident response tabletop exercise, a scenario begins with a client reporting unauthorized credit card charges shortly after making a payment through the organization's online portal. What is the most appropriate first action for the response team to simulate?

### Why this is right The scenario begins with a client reporting unauthorized charges following an online payment through the firm's portal. That report is the initial signal that participants must investigate, rather than proof by itself of where a breach occurred or who is responsible. ### The concept A tabletop exercise introduces a simulated event and asks participants to reason through decisions and responsibilities. In this case, the initial report should prompt the firm to identify the payment systems involved, determine whether it stores cardholder data, and begin documenting its response. Later facts, such as suspicious access from a personal laptop, belong to the investigation stage. ### The other options - **B. The external consultant reports that the firm failed a completed audit.**: The exercise includes a simulated compliance audit, but a failed audit is not the stated trigger. - **C. The Office Manager discovers that all client files were deleted.**: File deletion is not part of the scenario. - **D. The Legal Partner receives a notice that the billing platform has been shut down.**: The scenario does not say the platform is shut down. ### Terms - **Tabletop exercise**: A discussion-based simulation used to practise decisions about a hypothetical incident. ### Remember Treat the first report as a signal to investigate, not as a complete explanation of the incident.