CAS-004 Security Operations Practice Question
A SOC team is implementing a SOAR playbook to automate response to phishing emails reported by users. Which step should be included in the playbook to prevent other users from accessing the malicious link?
⚠ Common exam trap
CAS-005 often tests the difference between containment and remediation actions, leading candidates to choose actions that address the reporter's device rather than organization-wide protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block the malicious URL in the web proxy
Blocking the malicious URL in the web proxy prevents all users from accessing the phishing link, effectively containing the threat. This step is proactive and protects the entire organization, not just the reporter.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Isolate the reporter's workstation
Why it's wrong here
Isolating the reporter's endpoint contains a possible infection on one host; it does nothing to stop other users clicking the same URL. It is tempting because isolation is a core SOAR containment action, and it would be correct if the reporter's machine showed signs of active compromise.
- ✗
Reset the reporter's password
Why it's wrong here
Resetting the reporter's password addresses credential theft on one account, not the link's reachability for everyone else. It is tempting because password reset is a routine playbook step, and it would be correct if the reporter had entered credentials into the phishing page.
- ✓
Block the malicious URL in the web proxy
Why this is correct
A web proxy enforces URL filtering at the egress path, so adding the malicious URL to its blocklist stops any user from resolving or reaching that link. This satisfies the requirement to prevent other users accessing it, containing the campaign before further credentials or payloads are delivered.
- ✗
Delete the email from all mailboxes
Why it's wrong here
Deleting the email from all mailboxes removes the message after delivery, but the link may already have been clicked or shared, and it does not block access to the malicious URL itself. It is tempting because mailbox purge is the standard containment step for confirmed phishing campaigns, and it would be correct when the goal is removing delivered messages rather than preventing link access.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.