CS0-003 Security Operations Practice Question
A CASB alert indicates that a user downloaded a file containing sensitive data from a cloud app to an unmanaged device. Which action should the analyst take first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Investigate the alert to confirm the data exfiltration
The first step is to verify the alert is a true positive by checking the user's activity and the file's sensitivity. Prematurely blocking or reporting may be incorrect if the alert is a false positive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Report the incident to law enforcement
Why it's wrong here
Reporting an unverified event to law enforcement is premature and violates standard incident response lifecycles. Organizations must first conduct an internal investigation to confirm a breach, assess scope, and determine legal reporting thresholds before involving external authorities. Doing so prematurely can lead to unnecessary legal complications and reputational damage.
- ✗
Reset the user's password
Why it's wrong here
While credential rotation is a common containment strategy, resetting the user's password immediately is premature without confirming an actual account compromise. If the download was a legitimate business activity, this action unnecessarily disrupts operations and alerts a potential insider threat that their activities are being monitored, compromising the investigation.
- ✗
Block the user's cloud app access
Why it's wrong here
Blocking access to the cloud application immediately can severely disrupt legitimate business operations if the CASB alert turns out to be a false positive. Containment actions should be proportional to verified risks, meaning analysts must first validate the alert's severity and context before revoking user permissions.
- ✓
Investigate the alert to confirm the data exfiltration
Why this is correct
The first phase of the incident response lifecycle following detection is analysis and validation. Analysts must investigate the CASB alert to rule out false positives, determine the classification of the downloaded file, and verify whether the activity constitutes actual unauthorized data exfiltration before initiating containment or eradication protocols.
Go deeper
Related to this question
Learn chapter
Cloud Incident Response in AWS and Azure
Key term
Alert
An alert is a notification that something unusual or potentially harmful has happened in a computer system or network.
Key term
False positive
A false positive is an alert or result that indicates a security threat or vulnerability exists when in fact there is no real issue.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.