A regional bank has just finalised a new disaster recovery plan for its core banking platform after a major rewrite. The CISO wants the first exercise to validate that recovery procedures are documented correctly and that named recovery team members understand their roles, without disrupting production or requiring infrastructure to be brought up at the alternate site. Which DRP testing method should the CISO direct the team to perform FIRST?
- AA structured walkthrough where recovery team members talk through the documented procedures step by step in a facilitated session Correct
- BA parallel test that brings the alternate site online and processes a copy of live transactions alongside production
- CA full-interruption test that fails production over to the alternate site during a scheduled maintenance window
- DA simulation exercise in which an injected scenario drives the team to execute recovery actions against test systems under time pressure
Why A is correct: A walkthrough (tabletop) exercise is the appropriate first test after a major plan revision: it is low risk, validates that the written procedures are coherent and that team members understand their assigned roles, and surfaces gaps before any technical or operational disruption occurs.
Why B is wrong: A parallel test is a strong validation that the alternate site can process real workloads, but it requires the recovery environment to be ready and consumes significant staff effort; it is premature when the plan document itself has not yet been walked through by the recovery teams.
Why C is wrong: A full-interruption test is the most rigorous form of DRP testing and the one most likely to prove real recoverability, but it carries the highest business risk and should only be attempted after lower-impact tests have validated documentation, roles, and infrastructure readiness.
Why D is wrong: A simulation is valuable for stressing decision making under realistic pressure, but it assumes the team already understands the documented procedures; running one before a walkthrough risks measuring confusion in the plan rather than the team's response capability.