CISSP - Security Operations - Section 7.12

Test disaster recovery plans (DRP) using read-through, walkthrough, simulation, parallel, and full-interruption tests.

Compare DRP testing methods - read-through, tabletop exercise (walkthrough), simulation, parallel test, and full-interruption test - in terms of cost, disruption risk, and the fidelity of findings they produce. Select the appropriate test type for a given organisational risk tolerance and recovery plan maturity level.

DRP testingtabletop exerciseparallel testfull-interruption testsimulation

Practice question for this objective

Free sampleSecurity Operationsmedium

A regional bank has just finalised a new disaster recovery plan for its core banking platform after a major rewrite. The CISO wants the first exercise to validate that recovery procedures are documented correctly and that named recovery team members understand their roles, without disrupting production or requiring infrastructure to be brought up at the alternate site. Which DRP testing method should the CISO direct the team to perform FIRST?

  • AA structured walkthrough where recovery team members talk through the documented procedures step by step in a facilitated session Correct
  • BA parallel test that brings the alternate site online and processes a copy of live transactions alongside production
  • CA full-interruption test that fails production over to the alternate site during a scheduled maintenance window
  • DA simulation exercise in which an injected scenario drives the team to execute recovery actions against test systems under time pressure
Select the lowest-impact DRP test type appropriate for validating a newly revised plan document and team role awareness. DRP testing methods are arranged on a continuum from least disruptive to most disruptive: read-through, walkthrough (tabletop), simulation, parallel, and full-interruption. After a substantial plan rewrite the priority is to confirm that the written procedures are internally consistent and that recovery personnel know what they are accountable for. A facilitated walkthrough achieves this without committing infrastructure or risking production, and any defects it surfaces can be corrected cheaply before more expensive tests are scheduled.

Why A is correct: A walkthrough (tabletop) exercise is the appropriate first test after a major plan revision: it is low risk, validates that the written procedures are coherent and that team members understand their assigned roles, and surfaces gaps before any technical or operational disruption occurs.

Why B is wrong: A parallel test is a strong validation that the alternate site can process real workloads, but it requires the recovery environment to be ready and consumes significant staff effort; it is premature when the plan document itself has not yet been walked through by the recovery teams.

Why C is wrong: A full-interruption test is the most rigorous form of DRP testing and the one most likely to prove real recoverability, but it carries the highest business risk and should only be attempted after lower-impact tests have validated documentation, roles, and infrastructure readiness.

Why D is wrong: A simulation is valuable for stressing decision making under realistic pressure, but it assumes the team already understands the documented procedures; running one before a walkthrough risks measuring confusion in the plan rather than the team's response capability.

See more CISSP practice questions, answers explained.

More in this domain

Back to all Security Operations objectives, or the CISSP cert hub.

Examworthy is not affiliated with or endorsed by (ISC)2. Original, blueprint-aligned practice material only.