mediumMultiple SelectObjective-mapped
CAS-004 Practice Question: A security analyst is investigating a potential…
A security analyst is investigating a potential data breach. The logs show that an attacker used a compromised service account to access sensitive files on a file server. Which TWO actions should the analyst take FIRST to contain the incident? (Choose TWO.)
⚠ Common exam trap
The CAS-004 exam often tests the distinction between containment, eradication, and recovery phases; the trap here is that candidates may confuse a recovery action (restoring backups) or a notification step (calling law enforcement) with the immediate containment priority of cutting off the attacker's access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reset the service account password and revoke any active tokens.
Resetting the service account password and revoking active tokens (C) immediately invalidates the attacker's current authentication credentials, preventing further unauthorized access via that compromised account. This is a critical containment step because service accounts often have persistent access and may use long-lived tokens or cached credentials that remain valid until explicitly revoked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the workstation logs for signs of malware.
Why it's wrong here
Checking endpoint logs is part of investigation, not immediate containment.
- ✗
Notify law enforcement and the organization's legal department.
Why it's wrong here
Notification is typically done after containment and legal review.
- ✓
Reset the service account password and revoke any active tokens.
Why this is correct
Immediately stops the attacker's access.
- ✓
Review and modify permissions on the file server to limit the account's access.
Why this is correct
Helps identify and prevent excessive privileges.
- ✗
Restore the affected files from a known good backup.
Why it's wrong here
Restoring is a recovery step, not containment.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.