CAS-004 Security Operations Practice Question
An organization is developing a SOAR playbook to handle phishing emails reported by users. Which of the following actions is most appropriate to automate in the first step of the playbook?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the email from all user mailboxes
The first step in a phishing response playbook should isolate the potentially malicious email to prevent further exposure. Automating the removal of the email from all user mailboxes is a common initial containment action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block the sender's email address at the gateway
Why it's wrong here
Blocking at the gateway is useful but may not remove already delivered emails; containment should address delivered emails first.
- ✓
Remove the email from all user mailboxes
Why this is correct
Removing the email from mailboxes is a containment action that limits further risk.
- ✗
Scan the attachment in a sandbox
Why it's wrong here
Sandbox analysis may be automated but is typically done after containment to avoid delay.
- ✗
Send an alert to the SOC analyst for manual analysis
Why it's wrong here
While alerting is important, automation should first contain the threat.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.