CAS-004 Security Operations Practice Question
A SOC team is implementing a SOAR playbook to automate the response to phishing emails reported by users. The playbook should perform initial triage and, if the email is determined to be malicious, take containment actions. Which TWO of the following actions should be included in the playbook? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automatically block the sender's email address in the email gateway
Common phishing response playbooks include extracting URLs and hashes for analysis and automatically blocking the sender's email address. Creating a ticket is not a containment action, and scanning the user's machine may be part of eradication but not initial containment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Send an alert to the user's manager for approval
Why it's wrong here
Automated playbooks should not require manual approval for initial containment; this slows response.
- ✗
Automatically create a ticket in the service desk system
Why it's wrong here
While useful, this is not a containment action; it is a workflow step.
- ✓
Automatically block the sender's email address in the email gateway
Why this is correct
This is a containment action to prevent further emails from that sender.
- ✗
Initiate a full antivirus scan on the user's workstation
Why it's wrong here
Initiating a full antivirus scan on the user's workstation is a remediation step that occurs after containment, not a containment action itself. The playbook specifically requires immediate containment to stop the threat from spreading, such as disabling the user's account or isolating the host via network access control. This option is tempting because antivirus scans are a standard response to confirmed malware, and they would be correct in a playbook focused on post-containment eradication or endpoint cleanup, where the goal is to remove the malicious payload rather than halt lateral movement.
- ✓
Extract embedded URLs and file hashes for threat intelligence lookup
Why this is correct
This helps determine maliciousness and can trigger further actions.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.