Which of the following activities would involve members of the incident response team and other stakeholders simulating an event?

Lessons learned sessions focus on analyzing past incidents to identify successes and areas for improvement. While they involve discussion, they do not simulate events in real time like tabletop exercises do; instead, they reflect on actual experiences rather than hypothetical scenarios.

Digital forensics involves the investigation and analysis of digital data following an incident. This process is technical and focuses on recovering and examining evidence rather than simulating a response scenario, which is the central purpose of a tabletop exercise.

Root cause analysis aims to identify the underlying reasons for an incident after it has occurred. Although it involves critical thinking and problem-solving, it does not simulate an event or response, but rather examines what happened and why, making it distinct from the participatory nature of tabletop exercises.