easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A SOC analyst receives an alert indicating that a…
A SOC analyst receives an alert indicating that a workstation has been making outbound connections to a known command-and-control (C2) IP address. The analyst initiates the incident response process. Which of the following should be the FIRST action taken?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the workstation from the network.
The first priority in incident response is to contain the threat to prevent further damage. Option D, isolating the workstation, stops the C2 communication and limits lateral movement. Option A (running a full antivirus scan) is reactive and may alert the attacker. Option B (notifying management and legal) is important but not first. Option C (deleting suspicious files) is premature without analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a full antivirus scan on the affected workstation.
Why it's wrong here
Scanning takes time and may not catch the malware.
- ✗
Notify the organization's management and legal team.
Why it's wrong here
Notification is important but not the first technical action.
- ✗
Delete the suspicious files identified by the antivirus.
Why it's wrong here
Deletion should come after collection and analysis.
- ✓
Isolate the workstation from the network.
Why this is correct
Isolation stops the immediate threat and prevents spread.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.