The correct answer is enriching URLs, detonating attachments in a sandbox, and collecting mailbox search counts, as these actions are non-destructive and reduce analyst workload by automating initial threat intelligence gathering. This approach aligns with a SOAR playbook for phishing that avoids destructive actions like quarantining or deleting emails until the threat is confirmed, instead using URL reputation checks and sandbox detonation to safely assess indicators. On the CompTIA CySA+ CS0-003 exam, this question tests your understanding of balancing automation with safety in incident response workflows, often appearing as a trap where candidates mistakenly choose destructive actions like blocking IPs or deleting emails in the first phase. For the detection engineering phase, tuning to reduce noise without losing signal involves adjusting thresholds or whitelisting benign indicators based on enrichment results, ensuring alerts remain actionable. Remember the mnemonic “Enrich, Detonate, Count” to recall the three safe, automated steps that keep the playbook non-destructive while lightening the analyst’s load.
CS0-003 Security Operations Practice Question
This CS0-003 practice question tests your understanding of security operations. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: sOAR playbooks prioritize enrichment and context gathering in early phases.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A SOC wants a SOAR playbook for suspected phishing that reduces analyst workload but avoids destructive action before confirmation. Which actions are appropriate for the first automated phase? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enrich URLs, detonate attachments in a sandbox, and collect mailbox search counts
Option D is correct because enrichment (URL reputation, sandbox detonation) and mailbox search counts are non-destructive, automated actions that gather threat intelligence without altering systems. This aligns with the SOC's requirement to reduce analyst workload while avoiding destructive actions before confirmation. In the detection engineering phase, tuning to reduce noise without losing signal involves adjusting thresholds or whitelisting benign indicators based on enrichment results.
Key principle: SOAR playbooks prioritize enrichment and context gathering in early phases.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Close all similar alerts as duplicates
Why it's wrong here
Similarity does not prove benign status or complete containment.
✗
Disable the reporting user's account immediately
Why it's wrong here
The reporter may not be compromised; disabling the account could be unnecessary.
✗
Automatically delete all messages from the sender across all mailboxes
Why it's wrong here
Deletion can be appropriate after validation, but automatic destructive action is risky at the first phase.
✓
Enrich URLs, detonate attachments in a sandbox, and collect mailbox search counts
Why this is correct
Early automation should gather context and evidence while keeping analysts in control of disruptive actions.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
SOAR playbooks prioritize enrichment and context gathering in early phases.
Common exam traps
Common exam trap: answer the scenario, not the keyword
CompTIA often tests the distinction between investigative actions (enrichment, sandboxing) and destructive actions (deletion, account disablement), where candidates mistakenly choose destructive options thinking they are efficient, but the question explicitly requires avoiding destructive action before confirmation.
Trap categories for this question
Similar concept trap
Similarity does not prove benign status or complete containment.
Detailed technical explanation
How to think about this question
Under the hood, SOAR playbooks use APIs to query threat intelligence platforms (e.g., VirusTotal, AlienVault OTX) for URL reputation and sandbox services (e.g., Joe Sandbox, Cuckoo) for attachment detonation, returning verdicts as structured data. Mailbox search counts via Exchange Web Services (EWS) or Graph API help identify the blast radius without modifying data. In detection engineering, tuning involves adjusting SIEM rule thresholds (e.g., reducing false positives by increasing the minimum number of recipients) or using allowlists for known benign senders, which preserves signal while reducing noise.
KKey Concepts to Remember
SOAR playbooks prioritize enrichment and context gathering in early phases.
URL enrichment queries threat intelligence for reputation and context.
Sandbox detonation safely analyzes suspicious attachments for malicious behavior.
Initial SOAR automation aims to reduce analyst workload by providing actionable intelligence.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
SOAR playbooks prioritize enrichment and context gathering in early phases.
Real-world example
How this comes up in practice
An employee at a financial services firm receives an email that appears to come from the IT helpdesk, asking them to reset their password via a link. The link leads to a convincing fake portal that harvests credentials. Security teams use phishing simulations and security-awareness training to reduce this attack vector. Questions like this test whether you can identify social engineering techniques and appropriate controls.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CS0-003 question in full detail.
Review sOAR playbooks prioritize enrichment and context gathering in early phases., then practise related CS0-003 questions on the same topic to reinforce the concept.
Security Operations — This question tests Security Operations — SOAR playbooks prioritize enrichment and context gathering in early phases..
What is the correct answer to this question?
The correct answer is: Enrich URLs, detonate attachments in a sandbox, and collect mailbox search counts — Option D is correct because enrichment (URL reputation, sandbox detonation) and mailbox search counts are non-destructive, automated actions that gather threat intelligence without altering systems. This aligns with the SOC's requirement to reduce analyst workload while avoiding destructive actions before confirmation. In the detection engineering phase, tuning to reduce noise without losing signal involves adjusting thresholds or whitelisting benign indicators based on enrichment results.
What should I do if I get this CS0-003 question wrong?
Review sOAR playbooks prioritize enrichment and context gathering in early phases., then practise related CS0-003 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
SOAR playbooks prioritize enrichment and context gathering in early phases.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CS0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-003 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.