A security operations center (SOC) wants to automatically trigger a response when a user account is locked out multiple times within a short period. The response should run a PowerShell script that disables the account and notifies the security team. The SOC uses Windows servers and wants to use built-in capabilities. Which configuration should be implemented?

Deploy a SOAR platform to ingest the event and run a playbook.

Create a scheduled task that triggers on Event ID 4740 (account locked out) and runs a PowerShell script that checks for multiple lockouts before disabling.

Use a PowerShell script that runs continuously in a loop, polling the security event log every minute.

Configure a Bash script via WSL to monitor the event log and disable accounts.

A security team wants to automate the response to a security alert that is generated by a cloud provider's monitoring service. The response should involve calling a cloud API to isolate a compromised resource. The team wants to use a serverless function to handle the response. However, the team is concerned about the function timing out if the API call takes too long. Which approach best addresses this concern?

Increase the timeout of the serverless function to the maximum allowed.

Use a SOAR platform to handle the response instead of a serverless function.

Use an asynchronous pattern where the serverless function triggers a separate process or workflow to handle the API call.

Use a virtual machine instead of a serverless function to run the response script.

A security operations center (SOC) wants to automate the response to phishing emails reported by users. The automation should extract indicators from the email, check them against threat intelligence, and automatically create a ticket if the indicators are malicious. The SOC wants to use a SOAR platform. Which capability of SOAR is most relevant for this task?

Playbooks that orchestrate the steps of extraction, enrichment, and ticket creation.

A dashboard that displays metrics on reported emails.

A ticketing system integration that creates tickets manually.

A threat intelligence feed that provides indicators.

CompTIASecurityX (CASP+)

Domain 3Objective 1

Automation CAS-005 Practice Questions (Page 4)

Part of the Security engineering domain, which accounts for 31% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~20–34 in this domain), expect 4–7 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

11concepts

31%of the exam

Questions 16–20

16application · medium
A security operations center (SOC) wants to automatically trigger a response when a user account is locked out multiple times within a short period. The response should run a PowerShell script that disables the account and notifies the security team. The SOC uses Windows servers and wants to use built-in capabilities. Which configuration should be implemented?
Select an answer first
17expert · hard
A security team wants to automate the response to a security alert that is generated by a cloud provider's monitoring service. The response should involve calling a cloud API to isolate a compromised resource. The team wants to use a serverless function to handle the response. However, the team is concerned about the function timing out if the API call takes too long. Which approach best addresses this concern?
Select an answer first
18foundation · easy
What is a common tool used to design and run automated workflows in security operations?
Select an answer first
19application · medium
A security operations center (SOC) wants to automate the response to phishing emails reported by users. The automation should extract indicators from the email, check them against threat intelligence, and automatically create a ticket if the indicators are malicious. The SOC wants to use a SOAR platform. Which capability of SOAR is most relevant for this task?
Select an answer first
20foundation · easy
A security analyst needs to retrieve the list of all enabled Windows services on a local machine and export the results to a CSV file for further analysis. Which PowerShell cmdlet would the analyst use to accomplish this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.

Automation CAS-005 Practice Questions (Page 4)

Questions 16–20

What is a common tool used to design and run automated workflows in security operations?

A security analyst needs to retrieve the list of all enabled Windows services on a local machine and export the results to a CSV file for further analysis. Which PowerShell cmdlet would the analyst use to accomplish this task?

Keep studying — Security engineering