CAS-004 Security Operations Practice Question
An organization is implementing a SOAR solution to automate responses to common incidents. They want to create a playbook for phishing email handling. Which of the following actions should be automated in the playbook after a user reports a suspicious email?
⚠ Common exam trap
CAS-005 often tests whether candidates pick a manual or overly broad action (call the user, warn everyone, delete all emails) instead of the targeted enrich-and-contain automation that SOAR is designed for.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Extract URLs and attachments, query threat intel feeds, and if malicious, block indicators and isolate the affected endpoint
A phishing-handling playbook should automate the enrichment and containment steps: extract URLs and attachments, query threat intelligence feeds, and if indicators are malicious, block them and isolate the affected endpoint. This is the standard SOAR pattern of 'enrich, decide, contain' that reduces mean time to respond and removes manual toil. It is deterministic, API-driven, and safe to automate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Extract URLs and attachments, query threat intel feeds, and if malicious, block indicators and isolate the affected endpoint
Why this is correct
Extracting URLs and attachments, querying threat intelligence, then blocking indicators and isolating the endpoint chains deterministic enrichment and containment actions that require no human judgement, satisfying the stem's automation requirement. These steps execute faster than manual triage while preserving analyst review for ambiguous verdicts.
- ✗
Call the user to confirm they clicked the link
Why it's wrong here
Calling the user introduces a manual, human-dependent step, which contradicts the automation goal of the playbook. Verification by phone cannot execute unattended and stalls the response workflow. This action suits high-severity incidents needing analyst judgement, such as suspected credential compromise, where human confirmation of user actions is genuinely required before containment.
- ✗
Send a warning email to all users
Why it's wrong here
Broadcasting a warning to all users is a mass communication, not a containment action tied to the reported message, and it risks alert fatigue. It fits post-incident awareness campaigns once a confirmed widespread threat is established.
- ✗
Immediately delete the email from all user inboxes
Why it's wrong here
Deleting from all inboxes risks destroying evidence and removing legitimate mail before analysis, and cannot be undone. It is tempting because containment is a valid SOAR action, but only after verdict and scoping; the correct playbook step quarantines the message pending investigation.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.