Blocking Malware Command and Control With IP-Based Firewall Rules
Answer
Correct answer: B — IP-based firewall rules block the malware's command-and-control connections at once, severing the channel it needs in order to function.
A security analyst is responding to a malware incident at a company. The malware connects to a command-and-control server on the internet in order to function. Which of the following should the security analyst implement first?
Community Votes
60% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The stem states that the malware depends on reaching a command-and-control server, so the first action must target that dependency. A firewall rule is surgical and can be pushed in minutes, while segmentation is a planned change that follows containment rather than replacing it.
Because the malware needs its command-and-control channel in order to operate, the fastest way to stop it is to block the known command-and-control addresses with IP-based firewall rules. That single change severs the command channel immediately and buys time for the slower architectural work of segmenting and rebuilding the network.
Defaulting to network segmentation because containment comes first in the incident response process. Segmentation is the right long-term hardening step, but it takes planning and rollout, so it is slower than a blocking rule that kills the command channel at once.
Community Discussion (25 comments)
agfencer
👍 3
Selected: B
Adding a IP based firewall rule is a lot quicker then looking at the network structure to modify it. B , first you add a quick firewall rule to block the malicious command and control IP then you make network segmentation changes for future proofing
shady23
👍 1
Selected: A
A. Network segmentation
LayinCable
👍 2
Selected: B
Network segmentation IS NOT the same as containment OR isolation. It isn't a defense tactic, it's a network architecture setup for a performance boost amongst other things, but it isn't isolation from the rest of the network.
AspiringNerd
👍 1
In the context of CompTIA, "segment" and "containment" might refer to different concepts. "Segment" could relate to dividing networks for security or organizational purposes, while "containment" often refers to isolating threats within a network to prevent their spread. They're related but not necessarily synonymous. Yes, from ChatGPT.. but we’re confusing segmentation and containment I think. Segmentation, containment and isolation all have different meaning when refers g to CompTIA.. confusing I know.
mikzer
👍 1
Selected: A
Also see Q661 and 677. It takes more time to create new IP firewall rules that should be done after containment. Or eradication.
durel
👍 2
Selected: B
b is better
russian
👍 1
Selected: B
in order to stop the attack you first need to B. implement firewall rules. After that you can A. segment the network to make it even more harder to access command and control.
Iykeokebata
👍 2
Selected: B
Implementing IP-based firewall rules can immediately help block traffic to and from known malicious IP addresses associated with the command-and-control servers. This action effectively cuts off the malware's ability to receive commands or exfiltrate data, thus containing the infection.
mrface33
👍 4
Selected: B
The question explained that it is connecting to a command and control. If the question was asking how would you stop the spread on the network it'd be A but since the emphasis was on the command and control it's B
russian
👍 1
Selected: A
what this guy said: Mizzcoors
cd48a66
👍 2
Selected: B
The most effective and immediate action to take in this scenario is B. IP-based firewall rules. By quickly implementing firewall rules to block the known IP addresses of the C&C server, the security analyst can effectively stop the malware from communicating with its external controllers, thus mitigating the threat. This action directly addresses the most urgent need: stopping the malware's active threat to the network.
_deleteme_
👍 3
B - You can verify in Professor Messers class on bots. Link is below along with the last sentence "You can often identify an active infection by scanning an on-demand anti-malware scan and watching the network for any unusual traffic patterns. And if you know the type of network flows that will be used for the command and control, you can block that at the firewall or with an IPS or firewall at the workstation level." https://www.professormesser.com/security-plus/sy0-601/sy0-601-video/bots-and-botnets-2/
Mizzcoors
👍 4
Selected: A
If we follow the Incident Response Process: 1) Preparation - hardening 2) Identification - detection 3) Containment :) 4) Eradication 5) Recovery 6) Lesson Learned Performing containment involves isolating or segregating the affected servers and resources to prevent further unauthorized access or data exfiltration. This can be done by disconnecting the compromised systems from the network, disabling their access to sensitive data or critical resources, or implementing network segmentation to isolate the affected parts of the infrastructure.
users123n4
👍 1
Setup DNS sinkhole by setting ip-based firewall rules to locate the infected machines.
ps1hacker
👍 2
Selected: A
Containment comes first. Then you deal with blocking the IPs, etc.
slapster
👍 4
Selected: A
After an incident is identified, containment is the first step. CompTIA defines containment as either isolation-based or segmentation-based: Isolation-based containment is "making sure that there is no longer an interface between the affected component and your production network or the Internet." (Section 17C). Segmentation-based containment is specifically mentioned as being a tactic against an established C&C channel. "As opposed to completely isolating the hosts, you might configure the protected segment as a sinkhole or honeynet and allow the attacker to continue to receive filtered (and possibly modified) output over the C&C channel to deceive him or her into thinking the attack is progressing successfully." (Section 17C). I don't believe any of the answer choices besides Network Segmentation (A) allows for containment of the incident. IP-based firewall rules and content filters are undoubtedly configuration changes to be implemented to prevent future/ongoing communication , they would not take priority over containment.
Benrosan
👍 2
Selected: B
Block malicious IP first
Yomzie
👍 1
The security analyst should FIRST implement containment. Once you've identified the systems/hosts that are infected, please ISOLATE them via Network Segmentation. Thereafter, you can start battling with other forms of remediation.
ganymede
👍 1
Selected: B
B. IP-based firewall rules D. Content filler. Both B and D are correct. You can accomplish this with either IP firewall rules or content filters. I'm just guessing that IP firewall rules is "more" correct.
zecomeia_007
👍 1
Selected: B
First you need block ip
dc3a67e
👍 1
B. IP-based firewall rules When responding to a malware incident where the malware connects to a command-and-control server on the internet, the first step a security analyst should implement is IP-based firewall rules.
david124
👍 1
From the book: "content filter can help prevent malware from phoning home or connecting to C2 sites and it can also prevent users from responding to phishing attacks and similar sites"
david124
👍 1
Selected: D
The IP can be changed from a pool of IPs so no. best answer here is D
LuckyAro
👍 2
Selected: A
Network Segmentation
psowrong
👍 2
Selected: B
Firewall rules do the job.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The scenario states that the malware connects to a command-and-control server in order to function, so the implant's capability depends entirely on that outbound channel. Blocking the known command-and-control addresses with IP-based firewall rules removes the dependency immediately, which stops the malware from receiving instructions or exfiltrating data without waiting for a broader redesign. A firewall rule is a configuration change an analyst can push in minutes and can be scoped tightly to the malicious destinations, which contains the incident while minimising disruption to legitimate traffic.Why the Other Options Are Wrong
Network segmentation is a valid mitigation and CompTIA lists it alongside isolation and containment, but it is an architectural change that must be planned, tested, and rolled out, so it cannot be the first action while an active command-and-control channel is established. Mobile device management governs phones and tablets and has no bearing on server-side malware reaching an internet server. A content filter inspects web and application traffic and can block command-and-control domains, but it works at a coarser layer and cannot deny traffic to specific malicious IP addresses as immediately as a firewall rule does.Community Comment Notes
The majority chose IP-based firewall rules, with agfencer arguing that a blocking rule is far quicker than reworking the network structure and mrface33 noting that the stem's emphasis on the command-and-control server makes the firewall rule the intended answer. A substantial minority chose network segmentation, and slapster cited CompTIA's containment definition plus the segmentation-based containment tactic to support it. Mizzcoors mapped the choice onto the incident response process and listed containment as the third step, which is why the segmentation argument remains persuasive to some readers.Official Reference
Exam Strategy
When a question says a threat needs a specific channel in order to function, the first action is the one that severs that channel with the least disruption. Reserve architecture-level answers such as segmentation for questions that ask about preventing spread or hardening afterward, not for what should be done first during an active incident.
Frequently Asked Questions
Why is network segmentation not the first step when malware is contacting a command-and-control server?
Segmentation is effective but it is an architectural change that takes planning and rollout, so it is slower than pushing a firewall rule that blocks the command-and-control addresses already in use.
How is a content filter different from an IP-based firewall rule for stopping command-and-control traffic?
A firewall rule can deny specific destination IP addresses immediately, while a content filter works at the application and web layer and cannot cut established traffic to a known malicious IP as directly.