A response team cannot distinguish test alerts from real alerts during an exercise. What preparation would most help?

1. Use real customer data without controls
2. Clear exercise scope, labeling, control procedures, and escalation safeguards
3. Never run an exercise again
4. Disable all production monitoring for the exercise