CAS-004 Security Operations Practice Question
A security analyst is using a SOAR platform to automate response to phishing emails reported by users. The playbook should perform the following actions in order: (1) extract indicators from the email, (2) query threat intelligence feeds for reputation, (3) if malicious, block the sender's domain at the email gateway and delete the email from all user inboxes. Which type of playbook step is most appropriate for step 3?
⚠ Common exam trap
The trap is confusing conditional step with action step because step 3 is preceded by a condition ('if malicious'), but the step itself is the action taken, not the evaluation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Action step
Step 3 involves performing concrete actions: blocking the sender's domain and deleting the email. In SOAR playbooks, these are action steps that execute response activities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Playbook trigger
Why it's wrong here
A playbook trigger initiates execution when an event such as a reported phishing email arrives; it cannot sit at step 3 and perform containment. It is tempting because the playbook itself was triggered by a user report, but that trigger already occurred before step 1 and cannot block or delete anything.
- ✗
Output step
Why it's wrong here
An output step formats or returns playbook results to a user or downstream system; it cannot block a domain at the gateway or delete mail from inboxes. It is tempting because step 3 does produce an outcome, but that outcome requires executing containment actions through integrated tools, not reporting.
- ✓
Action step
Why this is correct
Blocking the sender's domain at the gateway and deleting the email from all inboxes are automated response actions executed against infrastructure. An action step performs these containment tasks, satisfying the playbook requirement that step 3 remediate confirmed-malicious email rather than merely enrich or decide.
- ✗
Conditional step
Why it's wrong here
A conditional step evaluates a decision, such as whether the reputation query returned malicious, and routes execution down a branch; it performs no blocking or deletion itself. It is tempting because step 3 is prefaced by "if malicious", but that condition belongs to the branching logic, while the actions need an action step.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.