CAS-004 Security Operations Practice Question
A security operations team is developing a SOAR playbook to automate response to a detected ransomware outbreak. The team wants to ensure the playbook can contain the threat quickly while minimizing business disruption. Which TWO actions should the playbook include as automated responses? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block outbound traffic to known malicious IP addresses and domains
Isolating affected systems and blocking communication to known command-and-control (C2) servers are effective containment actions. Isolating prevents lateral movement, and blocking C2 disrupts the ransomware's ability to receive instructions or exfiltrate data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a full antivirus scan on all systems
Why it's wrong here
Scanning is not a containment action and may be slow; isolation and blocking are more immediate.
- ✗
Restore all systems from the latest backup automatically
Why it's wrong here
Automated restoration without verification could reintroduce the infection or cause data loss.
- ✗
Power off all affected servers immediately
Why it's wrong here
Powering off may cause data loss and prevent forensic analysis; containment is preferred.
- ✓
Block outbound traffic to known malicious IP addresses and domains
Why this is correct
Blocking C2 communication can stop the ransomware from encrypting further or exfiltrating data.
- ✓
Isolate the affected endpoints from the network
Why this is correct
Isolation prevents the ransomware from spreading to other systems.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.