hardMultiple ChoiceObjective-mapped
CAS-004 Incident Response First Steps Practice Question
A technology company suspects an insider threat is exfiltrating intellectual property. The security team has deployed user and entity behavior analytics (UEBA) and set up data loss prevention (DLP) rules. A UEBA alert flags a senior developer who is accessing the source code repository at 2 AM from a VPN connection that routes through a foreign country. The developer also recently downloaded a large quantity of source code—more than 10 times the normal volume. DLP policies are configured to block emails with attachments over 10 MB. Which of the following should the incident response team do FIRST?
⚠ Common exam trap
The trap is choosing to interview the user first (Option B) or relying solely on DLP (Option D). Interviewing could alert the insider and lead to data destruction, while DLP only covers email, not other exfiltration vectors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the developer's workstation and revoke access to the source code repository immediately.
The correct first step because the UEBA alert combined with anomalous behavior (access at 2 AM via foreign VPN, excessive download volume) strongly suggests malicious activity. Immediate isolation of the developer's workstation and revocation of repository access prevents further exfiltration and preserves evidence. Options A, B, and D are incorrect as they either focus on secondary controls, risk alerting the suspect, or delay containment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement stricter DLP policies to block large downloads from the repository.
Why it's wrong here
Preventive measures can be added later, but they do not address the ongoing threat.
- ✗
Conduct an informal interview with the developer to ask about the unusual activity.
Why it's wrong here
Interviewing may tip off the insider and result in destruction of evidence.
- ✓
Isolate the developer's workstation and revoke access to the source code repository immediately.
Why this is correct
Containment is critical given the high risk of active exfiltration.
- ✗
Review DLP logs to confirm that no emails containing source code were sent.
Why it's wrong here
Exfiltration can occur via other channels (USB, cloud upload) not covered by email DLP.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.