hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: After containing a confirmed security incident,…
After containing a confirmed security incident, the incident response team must plan for eradication. What must be done before eradication begins?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Determine the root cause of the incident
Before eradication can begin, the incident response team must determine the root cause of the incident. This ensures that the eradication steps are comprehensive and address the underlying vulnerability, preventing recurrence. Conducting a full forensic analysis (A) may be part of root cause determination but is not a separate prerequisite. Beginning eradication immediately (C) without understanding the root cause risks incomplete removal. Notifying law enforcement (D) is optional and not a required step before eradication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct a full forensic analysis of all systems
Why it's wrong here
Forensics can happen in parallel but root cause analysis is more targeted.
- ✓
Determine the root cause of the incident
Why this is correct
Root cause analysis ensures eradication addresses the entry point and method.
- ✗
Begin eradication immediately to minimize dwell time
Why it's wrong here
Eradication without root cause may leave residual threats.
- ✗
Notify law enforcement agencies
Why it's wrong here
Law enforcement notification is based on policy and not required before eradication.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.