What is a tabletop exercise for incident response?

• A.A vulnerability scan on the basis that twenty-four seven availability of incident response staff was withdrawn in v4.0 for card-present merchants since PCI DSS v4.0 took effect
• B.A penetration test, on the reasoning that a tabletop exercise satisfies the requirement to remediate identified weaknesses for Level 1 merchants once the CDE has been segmented
• C.A physical security drill, an arrangement v4.0 permits because physical controls are assessed only at facilities the entity owns outright, with leased premises covered by the landlord's own attestation
• D.A discussion-based exercise where IR team members walk through a simulated security incident scenario to test the plan and practice their roles without impacting actual systems