CAS-004 Security Operations Practice Question
A security operations center (SOC) is deploying a new endpoint detection and response (EDR) solution across 10,000 endpoints. The team wants to ensure that if the EDR agent is disabled or tampered with, the SOC is immediately alerted and the endpoint can be isolated. Which EDR capability should the team prioritize?
⚠ Common exam trap
The trap here is assuming that SIEM integration alone provides tamper detection and response, when it only forwards logs and does not prevent agent disablement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tamper protection with automated response actions
The requirement is to detect tampering and respond by isolating the endpoint. Tamper protection ensures the EDR agent cannot be easily disabled, and automated response actions can isolate the host. Other options focus on detection updates, logging, or encryption, which do not provide the needed tamper detection and immediate isolation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Full disk encryption with key escrow
Why it's wrong here
Full disk encryption protects data at rest if a device is lost or stolen, but it does not detect or prevent EDR tampering, nor does it provide automated isolation. It is unrelated to the requirement of alerting on agent disablement. This option addresses a different security control.
- ✓
Tamper protection with automated response actions
Why this is correct
Tamper protection prevents unauthorized disabling of the EDR agent, and automated response actions such as host isolation can be triggered when tampering is detected. This directly addresses the requirement to alert and isolate. Other features like signature updates or forensic analysis do not provide real-time tamper detection and response.
- ✗
Continuous signature updates from the vendor
Why it's wrong here
Continuous signature updates improve detection of known threats but do not prevent an attacker from disabling the EDR agent or trigger an immediate alert and isolation. The scenario requires tamper detection and response, not just updated signatures. This option addresses a different aspect of endpoint security.
- ✗
Integration with a SIEM for log forwarding
Why it's wrong here
SIEM integration enables centralized logging and correlation, but it does not inherently prevent tampering or automatically isolate an endpoint upon tamper detection. The SOC would receive logs, but without tamper protection, the agent could be disabled before logs are sent. This option alone does not meet the immediate alert and isolation requirement.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.