Mitigating Unusual Network Scanning from Non-Business Countries
Given a scenario, analyze indicators of potentially malicious activity
A cybersecurity analyst notices unusual network scanning activity coming from a country that the company does not do business with. Which of the following is the best mitigation technique?
Answer
Correct answer: A — Geoblock the offending source country to deny unauthorized traffic from regions with no business justification.
Community Insight
The scenario tests the ability to distinguish between specific IP blocking and geographic policy enforcement based on business justification.
This question addresses the mitigation of malicious network scanning originating from countries with no business relationship. The correct approach leverages geographic context to implement broad but logical access controls.
Many candidates select blocking the specific IP address (D) or IP range (B), failing to recognize that scanning often involves spoofed IPs or large botnets, making geographic blocking the more effective strategic response for non-business regions.
Community Discussion (29 comments)
Sinakho
👍 1
Selected: B
You can't block a whole country because you might get a future client from that country you just blocked and they won't be able to access your network. The best thing to do is just block the IP.
Susan4041
👍 1
Selected: A
They can always change their IP so A is right its a country they do not do business with.
Susan4041
👍 2
Selected: B
A is too aggressive B makes more sense.
GDLY
👍 3
Selected: A
A is correct. Multi-billion dollar organization that I work for blocks every country we do not do business with. We make exceptions on a per user basis when they are out of the country
8f1fc75
👍 1
Another poorly worded question here. It could be A or B.
Lilik
👍 2
Selected: A
unusual network scanning activity - red flag. country i dont do business with - red flag. geoblock!
mmsbaseball3
👍 2
Selected: A
There is literally ZERO reason to have any traffic coming from that source country as they do not conduct business with them. If you block a specific IP range then the attacker can just spoof or obtain new IPs from the source country and continue their attack. Blocking the country as a whole will mitigate the risk forcing the attacker to utilize other TTPs. For those who are arguing for option 'B' because maybe the CEO may travel; in the real world the CEO will typically get with the SOC to advise of their ypcoming vacation and ask for apolicy or exception to be put in place for his network access.
cartman_sc
👍 1
Selected: A
A CompTIA tratou como geoblock a melhor opção no exame da Security+, então seguirei dessa forma.
MMK777
👍 1
Selected: B
when you block the IP range for a public from that country will be as good as block the whole country
bettyboo
👍 4
Selected: A
I choose A. Geoblock the offending source country, because we do it at my work and because the question specifically mentions that the company does not do business with that WHOLE country, and we know how CompTIA plays this game.
sheilawu
👍 5
Selected: A
I vote for A, cus our company is doing this so.
Budin
👍 1
Selected: A
Blocking high risk country that you did not have “business relation”
bmadajczyk
👍 1
Selected: B
I would agree with A if the country would be specify as a high risk country. In this case let's say you are german company not doing business in Belgium. Isn't geoblocking whole Belgium after 1 scan like shooting a fly with the nuke?
voiddraco
👍 2
I choose A but I also understand your point but you are reading more into it. With Comptia you gotta take it as it is in the question, thats what I got from taking all their certs, never over analyze.
👍 3
Selected: A
A is correct! Based on my work experience as an information security analyst. Re-read the question carefully. There's a reason it states the business does NOT conduct business with them. So the reasoning about it blocking legitimate traffic from users there or the CEO going on vacation there go out the window. Why would you allow incoming connections from a country you do no business with? Additionally, blocking just the range of IPs isn't a good option since the attacker can just use an IP outside of that range and they are in. Blocking by geolocation is a common practice. China, Russia, Moldova, etc.
JimmyJohnSubs
👍 7
In my opinion, this is a trick question. They are leading you to believe the country is an unfriendly country like Russia or China but what if you are not doing business with Canada and you geoblock the country. This will have an impact where users won't be able to browse certain websites or use certain services like VoIP Trunking just to list as an example. Microsoft products communicate with IPs in many different countries around the world. The two possible answers are A or D. I believe the answer is D in this case. B doesn't make sense since the scan source will either be a single IP or it will come from many random IPs that are not in any particular subnet that can be blocked.
bmadajczyk
👍 1
What if the country isn't China, Russia, Moldova? Based on my working experience it would be B. A is way to broad and blocking whole country based on 1 scanning IP is straight up stupid if it's not a high risk country.
👍 4
Also, this is common practice to block countries conducting unauthorized port scanning. Lookup recyber.net on Reddit. https://www.reddit.com/r/pfBlockerNG/comments/x0gty6/anyone_else_getting_a_ton_of_recyber_pings/ They have a lot of reports on AbuseIPDB for that exact reason. Port scanning.
DanJia
👍 2
A. based on my working experience
LiteralGod
👍 7
Selected: A
There's a reason the question mentions them not having any business in the source IP's country.
Saleh00
👍 2
I see that banning the geographical scope is better and it is true because in Sario, he explained to us important data that he does not deal with this company and that there is no dealing with this country with a company, that is, why I only ban IP may be an intruder or a hacker who wants to collect information or hack my company's system, and if I block ABB, I will not benefit, I may have a thousand IP deceive or in other ways as long as I do not work with us, take a geographical domain and there is no work in my company with them, I see that the best solution is the best closure or a geographical ban, so the answer to a geographical ban
fgiroux83
👍 4
Selected: B
For the ones thinking that a whole country should get blocked, think about the CEO going on a vacation in that country. Being unable to reach the office or the web site would probably not fly well.
psense
👍 2
You're making this more complicated than it should be.
👍 3
Hypothetical scenario. Question clearly states "a country that the company does not do business with". Why would the top dawg, the CEO, ever travel there? They're already being scanned by the offending country. You really think the CEO would risk going there and trying to connect back to the home site? That would be walking right into the lions den.
Jhonys
👍 3
Selected: B
Option A, geo-blocking the offending country of origin, is not the best choice due to the negative impact, the possibility of evasion and the overly broad approach. Option B, blocking the IP range from scans at the network firewall, is the most appropriate as it is straightforward, effective, flexible, and strikes a better balance in addressing the specific issue without harming legitimate traffic. Therefore, the answer is B. In summary, option B is the most effective and balanced choice to mitigate the threat of network scanning activities originating from a country with which the company does not do business.
kmordalv
👍 1
Selected: A
After reviewing my previous answer, I believe that the most advisable option would be option A.
nmap_king_22
👍 2
Selected: A
Very tough question. Chat gpt says B. I still stick to A tho. Blocking the entire IP range (or a significant portion) associated with the source country is a more comprehensive approach than blocking a single specific IP address (Option D). Attackers can easily change IP addresses, so blocking a range is more effective in limiting their access. Geoblocking (Option A) can be effective in some cases, but it might inadvertently block legitimate traffic or lead to false positives if the IP range includes legitimate users or services. Blocking the specific IP range associated with the scanning activity is a more targeted response.
ms123451
👍 1
Selected: A
They are clearly saying business is not conducted with that country, option A geo-blocking is the best answer with regards to the question. They wouldn't mention that if they wanted to choose option B only.
kmordalv
👍 1
Selected: B
Blocking the IP range of the scans at the network firewall (option B) is a proactive measure to prevent further network scanning activity from the suspicious source country. By blocking the entire IP range, you can effectively prevent any potential malicious traffic from that region from reaching your network, reducing the attack surface.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Geoblocking (Option A) is the most appropriate mitigation in this specific context because the company has explicitly stated it does not conduct business in the offending country. This provides a clear, defensible business rationale for denying all traffic from that region, effectively neutralizing scanning activity without the need for constant IP updates. It aligns with defense-in-depth strategies where access is granted only to necessary business zones.Why the Other Options Are Wrong
Blocking specific IPs (D) or ranges (B) is reactive and inefficient; attackers frequently rotate through thousands of IPs or use compromised hosts within allowed networks, rendering static blocks ineffective. Historical trend analysis (C) is a detection and reporting activity, not an immediate mitigation technique, leaving the organization vulnerable during the investigation phase.Community Comment Notes
Community consensus strongly supports geoblocking, citing real-world practices where organizations block entire nations they do not operate in. As one commenter noted, "There's a reason the question mentions them not having any business in the source IP's country," highlighting the importance of reading the prompt's constraints. Another user emphasized that "Multi-billion dollar organization... blocks every country we do not do business with," reinforcing that this is standard enterprise security posture rather than an edge case.Exam Strategy
Always look for the 'business justification' clue in CompTIA questions. If a restriction (like blocking a country) is tied to a lack of business need, it is likely the intended answer over technical workarounds like IP filtering.
Frequently Asked Questions
Why not block just the IP range instead of the whole country?
IP ranges are dynamic and easily spoofed. If there is no business need for the country, blocking the entire region is a more robust and manageable long-term strategy.
Is geoblocking considered too broad a control?
While it can impact legitimate users, the question specifies no business exists there, implying zero expected legitimate traffic. Thus, the broad block is justified by the risk profile.