Mitigating Unusual Network Scanning from Non-Business Countries

CS0-003 By islever Editorial Last updated

Given a scenario, analyze indicators of potentially malicious activity

Short answer

A Geoblock the offending source country to deny unauthorized traffic from regions with no business justification.

Question

A cybersecurity analyst notices unusual network scanning activity coming from a country that the company does not do business with. Which of the following is the best mitigation technique?
  1. Geoblock the offending source country. Correct Answer
  2. Block the IP range of the scans at the network firewall.
  3. Perform a historical trend analysis and look for similar scanning activity.
  4. Block the specific IP address of the scans at the network firewall.

Key Takeaways

The scenario tests the ability to distinguish between specific IP blocking and geographic policy enforcement based on business justification.

This question addresses the mitigation of malicious network scanning originating from countries with no business relationship. The correct approach leverages geographic context to implement broad but logical access controls.

Common mistake: Many candidates select blocking the specific IP address (D) or IP range (B), failing to recognize that scanning often involves spoofed IPs or large botnets, making geographic blocking the more effective strategic response for non-business regions.

Expert Analysis

Why the Answer Is Correct

Geoblocking (Option A) is the most appropriate mitigation in this specific context because the company has explicitly stated it does not conduct business in the offending country. This provides a clear, defensible business rationale for denying all traffic from that region, effectively neutralizing scanning activity without the need for constant IP updates. It aligns with defense-in-depth strategies where access is granted only to necessary business zones.

Why the Other Options Are Wrong

Blocking specific IPs (D) or ranges (B) is reactive and inefficient; attackers frequently rotate through thousands of IPs or use compromised hosts within allowed networks, rendering static blocks ineffective. Historical trend analysis (C) is a detection and reporting activity, not an immediate mitigation technique, leaving the organization vulnerable during the investigation phase.

Community Comment Notes

Community consensus strongly supports geoblocking, citing real-world practices where organizations block entire nations they do not operate in. As one commenter noted, "There's a reason the question mentions them not having any business in the source IP's country," highlighting the importance of reading the prompt's constraints. Another user emphasized that "Multi-billion dollar organization... blocks every country we do not do business with," reinforcing that this is standard enterprise security posture rather than an edge case.

Exam Strategy

Always look for the 'business justification' clue in CompTIA questions. If a restriction (like blocking a country) is tied to a lack of business need, it is likely the intended answer over technical workarounds like IP filtering.

Frequently Asked Questions

Why not block just the IP range instead of the whole country?

IP ranges are dynamic and easily spoofed. If there is no business need for the country, blocking the entire region is a more robust and manageable long-term strategy.

Is geoblocking considered too broad a control?

While it can impact legitimate users, the question specifies no business exists there, implying zero expected legitimate traffic. Thus, the broad block is justified by the risk profile.

More CS0-003 FAQ →

Discussion 29 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 29

  1. JimmyJohnSubs 👍 7
    In my opinion, this is a trick question. They are leading you to believe the country is an unfriendly country like Russia or China but what if you are not doing business with Canada and you geoblock the country. This will have an impact where users won't be able to browse certain websites or use certain services like VoIP Trunking just to list as an example. Microsoft products communicate with IPs in many different countries around the world. The two possible answers are A or D. I believe the answer is D in this case. B doesn't make sense since the scan source will either be a single IP or it will come from many random IPs that are not in any particular subnet that can be blocked.
  2. LiteralGod 👍 7 Answered A
    There's a reason the question mentions them not having any business in the source IP's country.
  3. sheilawu 👍 5 Answered A
    I vote for A, cus our company is doing this so.
  4. Anonymous learner 👍 4
    Also, this is common practice to block countries conducting unauthorized port scanning. Lookup recyber.net on Reddit. https://www.reddit.com/r/pfBlockerNG/comments/x0gty6/anyone_else_getting_a_ton_of_recyber_pings/ They have a lot of reports on AbuseIPDB for that exact reason. Port scanning.
  5. bettyboo 👍 4 Answered A
    I choose A. Geoblock the offending source country, because we do it at my work and because the question specifically mentions that the company does not do business with that WHOLE country, and we know how CompTIA plays this game.
Show 24 more comments
  1. fgiroux83 👍 4 Answered B
    For the ones thinking that a whole country should get blocked, think about the CEO going on a vacation in that country. Being unable to reach the office or the web site would probably not fly well.
  2. Jhonys 👍 3 Answered B
    Option A, geo-blocking the offending country of origin, is not the best choice due to the negative impact, the possibility of evasion and the overly broad approach. Option B, blocking the IP range from scans at the network firewall, is the most appropriate as it is straightforward, effective, flexible, and strikes a better balance in addressing the specific issue without harming legitimate traffic. Therefore, the answer is B. In summary, option B is the most effective and balanced choice to mitigate the threat of network scanning activities originating from a country with which the company does not do business.
  3. Anonymous learner 👍 3 Answered A
    A is correct! Based on my work experience as an information security analyst. Re-read the question carefully. There's a reason it states the business does NOT conduct business with them. So the reasoning about it blocking legitimate traffic from users there or the CEO going on vacation there go out the window. Why would you allow incoming connections from a country you do no business with? Additionally, blocking just the range of IPs isn't a good option since the attacker can just use an IP outside of that range and they are in. Blocking by geolocation is a common practice. China, Russia, Moldova, etc.
  4. Anonymous learner 👍 3
    Hypothetical scenario. Question clearly states "a country that the company does not do business with". Why would the top dawg, the CEO, ever travel there? They're already being scanned by the offending country. You really think the CEO would risk going there and trying to connect back to the home site? That would be walking right into the lions den.
  5. GDLY 👍 3 Answered A
    A is correct. Multi-billion dollar organization that I work for blocks every country we do not do business with. We make exceptions on a per user basis when they are out of the country
  6. Saleh00 👍 2
    I see that banning the geographical scope is better and it is true because in Sario, he explained to us important data that he does not deal with this company and that there is no dealing with this country with a company, that is, why I only ban IP may be an intruder or a hacker who wants to collect information or hack my company's system, and if I block ABB, I will not benefit, I may have a thousand IP deceive or in other ways as long as I do not work with us, take a geographical domain and there is no work in my company with them, I see that the best solution is the best closure or a geographical ban, so the answer to a geographical ban
  7. nmap_king_22 👍 2 Answered A
    Very tough question. Chat gpt says B. I still stick to A tho. Blocking the entire IP range (or a significant portion) associated with the source country is a more comprehensive approach than blocking a single specific IP address (Option D). Attackers can easily change IP addresses, so blocking a range is more effective in limiting their access. Geoblocking (Option A) can be effective in some cases, but it might inadvertently block legitimate traffic or lead to false positives if the IP range includes legitimate users or services. Blocking the specific IP range associated with the scanning activity is a more targeted response.
  8. mmsbaseball3 👍 2 Answered A
    There is literally ZERO reason to have any traffic coming from that source country as they do not conduct business with them. If you block a specific IP range then the attacker can just spoof or obtain new IPs from the source country and continue their attack. Blocking the country as a whole will mitigate the risk forcing the attacker to utilize other TTPs. For those who are arguing for option 'B' because maybe the CEO may travel; in the real world the CEO will typically get with the SOC to advise of their ypcoming vacation and ask for apolicy or exception to be put in place for his network access.
  9. voiddraco 👍 2
    I choose A but I also understand your point but you are reading more into it. With Comptia you gotta take it as it is in the question, thats what I got from taking all their certs, never over analyze.
  10. Lilik 👍 2 Answered A
    unusual network scanning activity - red flag. country i dont do business with - red flag. geoblock!
  11. psense 👍 2
    You're making this more complicated than it should be.
  12. Susan4041 👍 2 Answered B
    A is too aggressive B makes more sense.
  13. DanJia 👍 2
    A. based on my working experience
  14. kmordalv 👍 1 Answered B
    Blocking the IP range of the scans at the network firewall (option B) is a proactive measure to prevent further network scanning activity from the suspicious source country. By blocking the entire IP range, you can effectively prevent any potential malicious traffic from that region from reaching your network, reducing the attack surface.
  15. bmadajczyk 👍 1 Answered B
    I would agree with A if the country would be specify as a high risk country. In this case let's say you are german company not doing business in Belgium. Isn't geoblocking whole Belgium after 1 scan like shooting a fly with the nuke?
  16. bmadajczyk 👍 1
    What if the country isn't China, Russia, Moldova? Based on my working experience it would be B. A is way to broad and blocking whole country based on 1 scanning IP is straight up stupid if it's not a high risk country.
  17. ms123451 👍 1 Answered A
    They are clearly saying business is not conducted with that country, option A geo-blocking is the best answer with regards to the question. They wouldn't mention that if they wanted to choose option B only.
  18. Sinakho 👍 1 Answered B
    You can't block a whole country because you might get a future client from that country you just blocked and they won't be able to access your network. The best thing to do is just block the IP.
  19. MMK777 👍 1 Answered B
    when you block the IP range for a public from that country will be as good as block the whole country
  20. cartman_sc 👍 1 Answered A
    A CompTIA tratou como geoblock a melhor opção no exame da Security+, então seguirei dessa forma.
  21. kmordalv 👍 1 Answered A
    After reviewing my previous answer, I believe that the most advisable option would be option A.
  22. Susan4041 👍 1 Answered A
    They can always change their IP so A is right its a country they do not do business with.
  23. Budin 👍 1 Answered A
    Blocking high risk country that you did not have “business relation”
  24. 8f1fc75 👍 1
    Another poorly worded question here. It could be A or B.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Mitigating New Ransomware with Sandboxing Analysis

S-grade

Identifying Network Routing Anomalies Using ASN Lookups

S-grade

Next Step After Applying a Patch: Validation vs. Testing

S-grade

Missing Data from Network Vulnerability Scans

S-grade

← Back to CS0-003 Study Guide