CAS-004 Security Operations Practice Question
A SOC team is implementing a SOAR playbook to automate response to phishing emails reported by users. Which step should be included in the playbook to prevent other users from accessing the malicious link?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block the malicious URL in the web proxy
URL blocking in a web proxy prevents other users from accessing the malicious link, which is a common automated response in phishing playbooks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Isolate the reporter's workstation
Why it's wrong here
Isolating the reporter's workstation does not protect others.
- ✗
Reset the reporter's password
Why it's wrong here
Password reset addresses credential theft but not the link.
- ✓
Block the malicious URL in the web proxy
Why this is correct
Blocking the URL prevents access by all users.
- ✗
Delete the email from all mailboxes
Why it's wrong here
Deleting from mailboxes may not be possible if already forwarded.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.