CAS-004 Security Operations Practice Question
A security operations center (SOC) has deployed a SOAR platform to automate phishing response. An analyst wants to ensure that when a phishing email is reported, the platform automatically extracts all URLs from the email body and headers, submits them to a threat intelligence service, and then quarantines the email if any URL is malicious. Which SOAR component should the analyst configure to define this sequence of actions?
⚠ Common exam trap
Watch out — candidates often confuse the orchestration engine (which executes workflows) with the playbook (which defines the workflow logic).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Playbook
The requirement is to define an automated sequence of actions triggered by a phishing report. A playbook in SOAR is exactly this: a workflow that can include conditional logic, integrations with threat intelligence, and actions like quarantine. The other components either support execution, document procedures, or track cases but do not define the automation logic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Playbook
Why this is correct
A playbook is a predefined, automated workflow that executes a series of actions based on triggers and conditions. Here, the trigger is a reported phishing email, and the actions include URL extraction, threat intelligence lookup, and conditional quarantine. This directly matches the requirement to define a sequence of automated actions.
- ✗
Case management system
Why it's wrong here
A case management system tracks incidents and their details, but it does not automate actions like URL extraction or quarantine. It is used for documentation and collaboration, not for defining automated response sequences. The analyst needs a playbook to achieve the automation.
- ✗
Orchestration engine
Why it's wrong here
The orchestration engine is the underlying technology that executes playbooks, but it is not where the analyst defines the sequence of actions. Configuring the engine itself would not specify the phishing response steps; the logic is defined in a playbook that the engine runs.
- ✗
Runbook
Why it's wrong here
A runbook is typically a documented set of manual procedures or checklists for human operators. While it may guide incident response, it does not inherently provide automation or orchestration. The scenario requires automatic extraction and submission, which a runbook alone cannot enforce without a playbook.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.