Question 404 of 510

Security Engineering →mediumMultiple ChoiceObjective-mapped

Quick Answer

The answer is to add a specific deny rule for the malicious IP within the country allow rule, using an exception list. This is correct because a WAF geo-IP exception list allows you to maintain a broad geographic allow rule for legitimate business traffic while surgically blocking a known threat, creating a layered defense that satisfies both security and operational requirements. On the CompTIA SecurityX CAS-004 exam, this scenario tests your understanding of granular WAF rule management and the principle of least privilege applied to access controls—a common trap is choosing to remove the entire country block, which disrupts business, or switching to block mode, which causes false positives. Remember the memory tip: “Allow the country, deny the criminal”—exception lists let you carve out specific threats without breaking the business rule.

CAS-004 Security Engineering Practice Question

This CAS-004 practice question tests your understanding of security engineering. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company deploys a web application behind a WAF. The security team discovers that the WAF allows traffic from a known malicious IP. After investigating, they find the WAF is configured to allow all traffic from a specific country for business reasons. Which of the following is the BEST course of action?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

Question 1mediummultiple choice

Full question →

A
Deploy an additional IPS device to block the IP.
Why wrong: Adding another device increases complexity and cost; the WAF should be able to handle this through its own rules.
B
Remove the country-based allow rule immediately.
Why wrong: This would block all traffic from that country, potentially harming business operations and causing a denial of service for legitimate users.
C
Add a specific deny rule for the malicious IP within the country allow rule, using an exception list.
This allows legitimate traffic from the country while blocking the known malicious IP, addressing the threat without disrupting business.
D
Change the WAF from detection mode to blocking mode.
Why wrong: Switching to blocking mode may cause legitimate traffic to be blocked due to false positives; it does not specifically address the single malicious IP.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Add a specific deny rule for the malicious IP within the country allow rule, using an exception list.

Option C is correct because creating a geo-IP exception list for the malicious IP within the allowed country maintains business requirements while blocking the threat. Option A is wrong because removing the entire country block may disrupt business and is too broad. Option B is wrong because an IPS is a different control; adjusting WAF rules is more direct. Option D is wrong because changing the WAF to block mode may cause false positives and is a drastic change.

Key principle: ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Deploy an additional IPS device to block the IP.
Why it's wrong here
Adding another device increases complexity and cost; the WAF should be able to handle this through its own rules.
✗
Remove the country-based allow rule immediately.
Why it's wrong here
This would block all traffic from that country, potentially harming business operations and causing a denial of service for legitimate users.
✓
Add a specific deny rule for the malicious IP within the country allow rule, using an exception list.
Why this is correct
This allows legitimate traffic from the country while blocking the known malicious IP, addressing the threat without disrupting business.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Standard ACLs match source addresses.
✗
Change the WAF from detection mode to blocking mode.
Why it's wrong here
Switching to blocking mode may cause legitimate traffic to be blocked due to false positives; it does not specifically address the single malicious IP.

Common exam traps

Common exam trap: ACLs stop at the first match

ACLs are processed top to bottom. The first matching entry wins, and an implicit deny usually exists at the end.

Detailed technical explanation

How to think about this question

ACL questions test precision: source, destination, protocol, port and direction. A generally correct ACL can still fail if it is applied on the wrong interface or in the wrong direction.

KKey Concepts to Remember

Standard ACLs match source addresses.
Extended ACLs can match source, destination, protocol and ports.
The first matching ACL entry is used.
There is usually an implicit deny at the end.

TExam Day Tips

Check inbound versus outbound direction.
Read the ACL from top to bottom.
Look for a broader permit or deny above the intended line.

Key takeaway

ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.

Real-world example

How this comes up in practice

A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.

What to study next

Got this wrong? Here's your next step.

Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related CAS-004 ACL questions on filtering logic and placement.

Related CAS-004 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Scripting, Containers and Automation practice questions

Practise CAS-004 questions linked to Scripting, Containers and Automation.

Application Environment, Configuration and Security practice questions

Practise CAS-004 questions linked to Application Environment, Configuration and Security.

Governance, Risk and Compliance practice questions

Practise CAS-004 questions linked to Governance, Risk and Compliance.

Security Engineering practice questions

Practise CAS-004 questions linked to Security Engineering.

Security Architecture practice questions

Practise CAS-004 questions linked to Security Architecture.

Security Operations practice questions

Practise CAS-004 questions linked to Security Operations.

CAS-004 fundamentals practice questions

Practise CAS-004 questions linked to CAS-004 fundamentals.

CAS-004 scenario practice questions

Practise CAS-004 questions linked to CAS-004 scenario.

CAS-004 troubleshooting practice questions

Practise CAS-004 questions linked to CAS-004 troubleshooting.

Practice this exam

Start a free CAS-004 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

CAS-004 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this CAS-004 question test?

Security Engineering — This question tests Security Engineering — Standard ACLs match source addresses..

What is the correct answer to this question?

The correct answer is: Add a specific deny rule for the malicious IP within the country allow rule, using an exception list. — Option C is correct because creating a geo-IP exception list for the malicious IP within the allowed country maintains business requirements while blocking the threat. Option A is wrong because removing the entire country block may disrupt business and is too broad. Option B is wrong because an IPS is a different control; adjusting WAF rules is more direct. Option D is wrong because changing the WAF to block mode may cause false positives and is a drastic change.

What should I do if I get this CAS-004 question wrong?

Are there clue words in this question I should notice?

Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

What is the key concept behind this question?

Standard ACLs match source addresses.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This CAS-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-004 exam.