An organization wants to rehearse how staff respond to a cyberattack in a safe environment. Which activity most directly fits?

### Why this is right A structured exercise lets an organization rehearse response actions without waiting for a real attack. The lesson identifies Exercise in a Box as a tool for assessing organizational resilience in a safe environment. ### The concept Exercises test whether people understand their roles and whether response processes work as intended. They complement technical testing, such as penetration testing, because they can focus on organizational preparation and decisions as well as systems. ### The other options - **Removing all security controls**: this creates exposure rather than safely testing response readiness. - **Waiting for a real attack**: this tests response under actual harm instead of a controlled rehearsal. - **Disabling incident communication**: this obstructs response rather than rehearsing it. ### Terms - **Incident response exercise**: A planned rehearsal of actions an organization would take during a security incident. - **Resilience**: The ability to withstand and respond to disruption. ### Remember Rehearse response before an incident makes practice costly.