Cyber Security Incident Response: A Beginner Tabletop Exercise
Incident response is a coordinated process for assessing and handling security incidents. A beginner tabletop exercise lets you practise decisions with fictional evidence, without changing a real account or computer.
NIST SP 800-61 Revision 3 places incident response within cybersecurity risk management. Preparation depends on governance, asset knowledge and protective controls; detection, response and recovery feed improvements back into the organization. The exercise below is an original learning scenario, not a complete organizational response plan.
Scenario and roles
A fictional training application reports repeated login failures followed by a successful sign-in. A separate record shows a new role assignment. The account owner has not yet confirmed the activity. No evidence of data theft has been supplied.
Assign a learner as analyst, another participant as incident lead and a reviewer as application owner. If working alone, write each role’s decisions separately. The analyst collects and explains evidence; the incident lead coordinates decisions; the owner explains service impact and approves relevant changes.
Round 1: assess what is known
- Record detection time, source system, account and alert identifier.
- Check timezones and whether the login and role change share a reliable session or request reference.
- Request permitted authentication, MFA, role-change and application-action records.
- Separate confirmed observations, plausible explanations and unknowns.
The role change increases concern, but it could be an approved administrative action. Verify the actor and change approval. Do not write “account takeover confirmed” merely because the sequence looks suspicious.
Round 2: propose containment with an owner
| Decision | Question before action | Evidence to retain |
|---|---|---|
| Revoke a suspicious session | Which session is in scope, and who authorizes the action? | Session reference, decision time and result. |
| Restrict account access | What service or user work could be affected? | Approval, current permissions and verification. |
| Revert an unauthorized role | Was the change approved, and what dependencies exist? | Role-change event and before/after state. |
In this tabletop, record a proposed action instead of executing it. In real work, use the organization’s response authority and procedures. Preserve relevant evidence before changes when feasible, and coordinate urgent actions with the incident lead.
Round 3: recovery and closure
The exercise controller now confirms that the role change was unauthorized. Identify what must be investigated before restoring normal access: how the access occurred, whether additional sessions or permissions persist, which accounts and resources were affected, and whether the corrective actions work.
Define closure evidence rather than assuming a password reset resolves everything. Check approved access, relevant session state and follow-up monitoring. Record unresolved questions and assign each to an owner with a review date.
Use a decision log
Time | Observed evidence | Decision | Approver | Result | Open question 10:00 | Login alert | Request session context | Incident lead | Pending | MFA result? 10:15 | Unapproved role change confirmed | Propose role rollback | App owner | Tabletop only | Other affected accounts?
The timestamps are illustrative. Your completed log should show why each decision followed from the evidence available at that moment. Keep a separate list of actions discussed but not taken.
Optional round: review an AI-drafted handover
Give an approved AI tool only the fictional scenario and completed decision log. Ask for a handover with five fields: confirmed observations, unresolved questions, proposed actions, decision owners and supporting record references. Keep it as a draft for the incident lead to review.
Check that it does not turn a proposed session revocation into a completed action, invent data theft, or claim recovery before the closure checks pass. Annotate each correction and record who accepted the final handover. In this exercise, the tool has no access to accounts, containment controls or real incident data.
Compare the draft with your manual handover: did it omit an owner, an approval or an unresolved question? For a separate course focused on applying AI to defensive workflows, explore AI for Cybersecurity Training in Vizag.
Review the exercise
Discuss whether roles were clear, evidence was sufficient and service impact was considered. Choose one improvement, such as a clearer escalation contact or a missing audit event. Describe how you would verify that improvement in the next exercise.
Begin with the worked log timeline and account-review exercise if you need practice interpreting authentication and access evidence. Publish only fictional or properly authorized, sanitized material in your portfolio.
Continue learning
For guided networking, Linux, security labs and SOC practice, see Cyber Security Training in Vizag. Softenant offers the 3-month course for Rs. 15,000, with classroom and online batch options.