hardMultiple ChoiceObjective-mapped
Designing a SOAR Playbook for Phishing Incidents
A large enterprise is implementing a SOAR platform to automate incident response. The security team wants to create a playbook for handling phishing emails reported by users. The playbook should: 1) validate the reported email by checking headers and attachments, 2) automatically block the sender's domain at the email gateway if malicious, 3) create a ticket, and 4) send an automated response to the user. Which of the following describes the best approach to design this playbook?
Quick Answer
The answer is to use an automated triage step that extracts indicators, then present the verdict to an analyst in a manual approval step before executing blocks. This approach is correct because it balances automation efficiency with human oversight, ensuring that the SOAR playbook automation with approval validates the phishing email through header and attachment analysis before any irreversible action, like blocking the sender’s domain, is taken. On the CompTIA SecurityX CAS-004 exam, this tests your understanding of risk-based playbook design, where false positives are a major concern in automated incident response; a common trap is choosing a fully automated block without validation, which can disrupt business operations. Remember the memory tip: “Triage first, approve the block” — this reinforces that automated extraction and analysis should always precede a manual approval gate to prevent costly mistakes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an automated triage step that extracts indicators, then present the verdict to an analyst in a manual approval step before executing blocks.
It combines automated triage (extracting indicators) with a manual approval step before blocking, which balances efficiency and accuracy. This approach reduces false positives while still automating most of the workflow. Option A is incorrect because it relies entirely on manual investigation, defeating automation. Option B is risky because it blocks without validation, potentially causing false positives. Option D is overly aggressive and may disrupt business communications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a ticket and route it to a junior analyst for manual investigation, then close after user acknowledgement.
Why it's wrong here
This does not leverage automation and is inefficient.
- ✗
Immediately sandbox the attachment and block the sender's domain if the sandbox reports malicious behavior.
Why it's wrong here
Sandbox results may have false positives; immediate blocking is dangerous.
- ✓
Use an automated triage step that extracts indicators, then present the verdict to an analyst in a manual approval step before executing blocks.
Why this is correct
This balances automation with human oversight, reducing false positives.
- ✗
Automatically delete the email from all users' inboxes and send a warning to the organization.
Why it's wrong here
Too aggressive; may delete legitimate emails and cause disruption.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CAS-005
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC team uses a SOAR platform to automate incident response. They want to ensure that playbooks run with minimal human intervention but still require approval for actions that could cause service disruption. Which approach should be used?
hard- A.Require analyst sign-off for every playbook action.
- B.Use network isolation as a safety net for any action.
- ✓ C.Implement conditional manual approval for destructive actions.
- D.Configure the SOAR to automatically execute all playbook steps.
Why C: Conditional manual approval (option C) is the correct approach because it allows the SOAR platform to automatically execute low-risk actions while requiring human approval for high-risk or destructive actions that could cause service disruption. This balances automation efficiency with necessary oversight. Option A is inefficient and defeats automation. Option B is a technical control that does not address approval. Option D is unsafe as it removes all human checks.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.