Select ALL activities that belong primarily to preparation in an incident response program.

### Why this is right - **Developing response policies and playbooks** is preparation because it establishes procedures before an incident occurs. - **Training incident responders** builds the capability to carry out those procedures. - **Testing plans with tabletop exercises** checks whether roles, decisions, and communications will work under pressure. ### The concept Preparation establishes the people, procedures, tools, communication routes, monitoring, and backups needed for an effective response. A tabletop exercise is a discussion-based simulation in which participants work through a scenario without necessarily changing production systems. Restoring files and removing malware are response actions that occur after an incident has been identified. Preparation makes those later actions safer and more coordinated. ### The other options - **Restoring encrypted files from clean backups**: This is normally recovery after the threat has been contained and removed. - **Removing malware from a compromised endpoint**: This is eradication, not advance preparation. ### Terms - **Playbook**: A documented set of steps for handling a defined incident type. - **Tabletop exercise**: A guided discussion used to test plans and decisions. ### Remember Preparation builds readiness; response actions address an incident that is already occurring.