easyMultiple ChoiceObjective-mapped
CAS-004 A SOC analyst at a mid-sized company Practice Question
You are a SOC analyst at a mid-sized company. The SIEM alerts on anomalous outbound traffic from a finance workstation to an external IP address never seen before. The workstation belongs to an employee in the accounts payable department. The alert shows that 500 MB of data was transferred via SMB over the internet, which is unusual because internal file shares are normally used. The employee is currently logged in and is in a meeting across the building. The initial triage confirms the workstation is not domain-joined and has been bypassing corporate firewall rules using a personal VPN. Which of the following actions should you take FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the workstation by disabling the network port or using endpoint security tools to block connectivity.
Isolating the workstation stops the ongoing data exfiltration over SMB and prevents further damage. The employee is in a meeting and not at their desk, so they cannot be involved in the initial response. Containment is the priority before escalation or investigation. Option B may be necessary but not first; Option C and D could delay containment and alert the potential insider.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the workstation by disabling the network port or using endpoint security tools to block connectivity.
Why this is correct
Immediate containment stops the exfiltration and limits risk.
- ✗
Escalate the incident to the incident response team lead.
Why it's wrong here
Escalation is important but not the first technical step.
- ✗
Contact the employee's manager to discuss the situation.
Why it's wrong here
Notification without containment allows the activity to continue.
- ✗
Interview the employee about the suspicious activity.
Why it's wrong here
Interviewing may tip off a malicious insider and should occur after containment.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.