mediumMultiple ChoiceObjective-mapped
Mitigating SSH Brute Force Attacks: Firewall Deny and Allow Lists
A SOC analyst is reviewing a large volume of failed login attempts across multiple user accounts from a single external IP address. The attempts use common usernames and passwords over SSH (port 22). Which security control would be most effective at preventing this type of attack?
Quick Answer
The answer is to add the external IP address to the firewall deny list and implement an IP allowlist for SSH access. This is correct because the attack is a classic brute-force or password-spraying attempt originating from a single external source; blocking that IP at the network layer immediately stops all malicious traffic, while an allowlist ensures only pre-approved, trusted IPs can even reach the SSH service, effectively neutralizing the attack regardless of password strength or authentication method. On the CompTIA SecurityX CAS-004 exam, this scenario tests your understanding of network-layer access controls versus host-based defenses—a common trap is choosing account lockout policies, which are reactive and can cause denial of service, whereas a firewall deny and allowlist is proactive and surgically precise. Remember the memory tip: “Block the bad, allow the good—firewall rules stop brute force where it should.”
⚠ Common exam trap
It's easy for candidates to choose rate limiting (Option C) because it seems like a direct mitigation, but they fail to realize that rate limiting only slows the attack, whereas blocking the IP and using an allowlist stops it entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the external IP address to the firewall deny list and implement an IP allowlist for SSH access.
The attack is a brute-force or password-spraying attempt from a single external IP. Adding that IP to a firewall deny list immediately blocks all traffic from that source, while implementing an IP allowlist for SSH access ensures only trusted IPs can reach the service. This directly prevents the attack at the network layer, regardless of password strength or authentication method.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enforce a minimum password complexity policy for all users.
Why it's wrong here
Password complexity reduces the chance of successful authentication but does not prevent the attack.
- ✗
Require multi-factor authentication for all SSH logins.
Why it's wrong here
MFA prevents successful authentication but the attack still generates logs and resource usage.
- ✗
Implement rate limiting on SSH connections per source IP.
Why it's wrong here
Rate limiting slows down but does not stop a determined attacker; the source IP can still attempt logins.
- ✓
Add the external IP address to the firewall deny list and implement an IP allowlist for SSH access.
Why this is correct
This immediately blocks the attack and prevents any further attempts from that IP.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CAS-005
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the auth.log exhibit, what is the MOST appropriate immediate action to mitigate this attack?
easy- A.Disable root login and remove the admin account.
- B.Block the entire 192.168.1.0/24 subnet at the firewall.
- ✓ C.Configure fail2ban to block the IP address after a threshold of failed attempts.
- D.Change the SSH port to a non-standard port.
Why C: The log shows a brute-force attack against SSH. Installing fail2ban will dynamically block the IP after multiple failures. Option A is too broad and may block legitimate users from that subnet. Option B doesn't address the immediate attack. Option D is good practice but does not stop the ongoing attack immediately.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.