Protecting High-Value Assets via EDR When Perimeter Blocking is Restricted

CS0-003 By islever Editorial Last updated

Given a scenario, analyze indicators of potentially malicious activity Given a scenario, perform incident response activities

Short answer

A Add the IP address to the EDR deny list to protect high-value assets from further reconnaissance activity while maintaining necessary perimeter connectivity for legitimate users.

Question

A SOC analyst observes reconnaissance activity from an IP address. The activity follows a pattern of short bursts toward a low number of targets. An open-source review shows that the IP has a bad reputation. The perimeter firewall logs indicate the inbound traffic was allowed. The destination hosts are high-value assets with EDR agents installed. Which of the following is the best action for the SOC to take to protect against any further activity from the source IP?
  1. Add the IP address to the EDR deny list. Correct Answer
  2. Create a SIEM signature to trigger on any activity from the source IP subnet detected by the web proxy or firewalls for immediate notification.
  3. Implement a prevention policy for the IP on the WAF.
  4. Activate the scan signatures for the IP on the NGFWs.

Key Takeaways

The trap is assuming a network firewall can always block threats; the key insight is recognizing when host-based controls like EDR are the only viable option due to business continuity constraints.

This question explores incident response strategies when perimeter blocking is operationally restricted. The correct approach is to add the malicious IP to the EDR deny list to protect high-value assets directly.

Common mistake: Many candidates choose D (NGFW scan signatures) because they instinctively want to block traffic at the perimeter. However, this fails because the scenario states the firewall must allow the traffic to avoid outages, making network-level blocking impossible.

Expert Analysis

The Perimeter Constraint and the EDR Solution

The critical constraint in this scenario is that the perimeter firewall logs indicate the inbound traffic was allowed. In a real-world environment, blocking this traffic at the network edge often requires dropping the entire port or service, which would cause an outage for legitimate business users. The question explicitly frames this as a situation where you cannot simply "shut down the port" without causing a "massive self-inflicted outage." Therefore, any solution that relies on the perimeter firewall to block specific IPs (like Option D) is technically unfeasible given the operational constraints described.

Why EDR is the Correct Defense

Since the destination hosts are identified as high-value assets with EDR agents installed, the most effective immediate action is to leverage the endpoint layer. Adding the malicious IP address to the EDR deny list (Option A) allows the organization to maintain the open port for legitimate traffic while simultaneously blocking the attacker's access to those specific critical endpoints. This isolates the threat at the point of highest value without disrupting broader network services. Comments from the community support this reasoning, noting that EDR provides the only actionable block when the perimeter is constrained by business requirements.

Operational Consequences and Exam Strategy

Choosing a network-based block (D) ignores the explicit instruction that the firewall is currently allowing the traffic due to operational necessity. Choosing a SIEM signature (B) is purely reactive and offers no protection against "further activity," only visibility. Choosing a WAF policy (C) is incorrect because reconnaissance scanning is typically a network-layer activity, not necessarily web-application traffic protected by a WAF.

On the CS0-003 exam, always look for the intersection of asset criticality and operational constraints. If a network block causes an outage, look for host-based controls (EDR/HIPS) or application-layer controls that can achieve the same security goal without breaking the service. This question tests your ability to prioritize defense-in-depth layers when the primary perimeter control is insufficient or unavailable.

Official Reference

https://www.comptia.org/training/certifications/security-plus

This link opens the official vendor documentation in a new tab.

Exam Strategy

When analyzing incident response questions, first identify any operational constraints (e.g., 'must keep port open'). If perimeter blocking is ruled out by these constraints, immediately pivot to host-based solutions like EDR, HIPS, or application whitelisting. Always select the option that provides active prevention rather than just alerting (SIEM) or ineffective controls (WAF for non-web traffic).

Frequently Asked Questions

Why can't we just block the IP on the NGFW?

The scenario specifies that blocking the traffic at the perimeter would require shutting down the port, causing a massive outage for legitimate users. You must balance security with business continuity.

Is EDR really better than SIEM for blocking?

Yes. SIEM (Option B) only generates alerts and is reactive. EDR (Option A) can actively enforce policies to deny connections or processes, providing immediate protection against the malicious IP.

More CS0-003 FAQ →

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. Only12go 👍 6 Answered D
    A. Add the IP to the EDR deny list: EDR operates on endpoints. While the destination hosts are covered, this won't prevent initial connection attempts or protect other network assets. B. Create a SIEM signature for alerting: Helpful for visibility, but reactive only—doesn't block the activity. Good for correlation, but not a defense action. C. Implement WAF policy: A WAF is only effective against HTTP/S traffic targeting web applications. If the reconnaissance includes non-web protocols (which is likely), this won't stop it. 🛡️ Summary: D is the most comprehensive and proactive defense measure—it ensures reconnaissance from that IP is detected and blocked at the perimeter, protecting all internal assets, not just those with EDR.
  2. Popeyes_Chicken 👍 5 Answered B
    Stuck between B and D depending on what "further activity" entails, but I'm going with B. Preventing a precursor to a potential attack doesn't seem like it covers the full scope of what they're looking for in "further activity". However, using a SIEM to trigger on any activity from the source would allow an analyst to respond more effectively to tactic shifts / provide a wider safety net. D seems to narrow.
  3. Popeyes_Chicken 👍 4
    EDR works at the endpoint level. It doesn't prevent further reconnaissance at the network perimeter.
  4. Cyde 👍 2 Answered D
    I'm going with D because the security team is enabling specific security rules on the NGFWs to monitor and possibly block malicious activities associated with a particular IP address based on known threat signatures
  5. ybyttv 👍 2 Answered D
    Let the ngfw which is on the perimeter to block it. If you use siem to trigger notification, you will receive lots of notifications and spend your time on it. And you get nothing.
Show 6 more comments
  1. cj207800 👍 2 Answered D
    I agree with only12go
  2. agfencer 👍 1 Answered A
    The answer here is A, don't overthink it You cannot block reconnaissance at the perimeter if the port must stay open, The question states that "perimeter firewall logs indicate the inbound traffic was allowed." You cannot block that traffic at the network perimeter without shutting down the port and causing a massive self-inflicted outage for legitimate users. By adding the IP to the EDR deny list (A), you accept that you cannot stop the attacker from knocking on your perimeter door, but you guarantee that the second they try to cross the threshold and execute an exploit on your high-value asset, the endpoint will kill the connection. It protects the asset from the damage of the attack, which is the SOC's primary directive.
  3. Justheretolook 👍 1 Answered D
    The best action for the SOC to take in this scenario is: D. Activate the scan signatures for the IP on the NGFWs. ⸻ Here’s why: • The activity involves reconnaissance in short bursts, which is often indicative of scanning or probing behavior. • The perimeter firewall is currently allowing the traffic, which means the source IP is not yet being blocked. • The NGFW (Next-Generation Firewall) can inspect traffic and apply intrusion prevention signatures or scan detection policies. • Activating scan signatures for that IP will help detect and block future scanning behavior at the network edge, preventing further reconnaissance attempts.
  4. agfencer 👍 1
    Option D is a decoy. Activating network scan signatures against a low-and-slow stealth scan that is already authorized by an open firewall rule will only generate alert logs—it will not drop the packets. Because the perimeter cannot block this specific traffic pattern without dropping the entire legitimate business service, adding the IP to the EDR Deny List (A) is the only option provided that enforces a guaranteed, active block directly at the high-value target assets.
  5. Wolf541 👍 1 Answered A
    according to chat gpt:Adding the IP address to the EDR (Endpoint Detection and Response) deny list is the best immediate action in this scenario because it blocks further potential malicious activity from the source IP at the endpoint level. This approach directly protects the high-value assets, which already have EDR agents installed. It ensures the IP cannot interact with those critical systems, even if the traffic reaches them.
  6. Cyde 👍 1
    and the question says ..."the best action for the SOC to take to protect against any further activity from the source IP"...

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Mitigating New Ransomware with Sandboxing Analysis

S-grade

Identifying Network Routing Anomalies Using ASN Lookups

S-grade

Next Step After Applying a Patch: Validation vs. Testing

S-grade

Missing Data from Network Vulnerability Scans

S-grade

← Back to CS0-003 Study Guide