SY0-701 Question 226
Single answerGeolocationA company allows employees to access its cloud-based HR system remotely. The security team notices repeated password-spraying attempts against employee accounts from IP addresses registered in countries where the company has no employees, vendors, or business operations. Leadership wants a control that will quickly reduce this attack traffic without requiring changes on employee devices. Which of the following is the BEST solution to implement first?
- A
Configure a geofencing rule to block authentication attempts from countries where the organization has no legitimate business presence
- B
Require all employees to disable GPS on their mobile devices before accessing the HR system
- C
Replace password authentication with biometric authentication for all remote users immediately
- D
Implement full-disk encryption on employee laptops used to access the HR system
Show answer and explanation
Correct answer: A
Explanation
The best answer is to implement geofencing based on geolocation. In Security+ contexts, geolocation is commonly used as a conditional access or network access control factor to restrict logins from regions that are high risk or unnecessary for business operations. This helps reduce the attack surface, especially for password-spraying and credential-stuffing attempts originating from known foreign locations. A practical implementation could be at the identity provider, VPN, WAF, firewall, or cloud access layer. This aligns with common best practices such as applying conditional access policies, enforcing least privilege, and limiting exposure to regions where access is not required. Candidates should also recognize the limitation that IP geolocation is not perfect and can be bypassed through VPNs, proxies, or compromised hosts, so geofencing is usually one layer of defense rather than a complete solution. Complementary controls would include MFA, login anomaly detection, password lockout or throttling, and monitoring of impossible travel events.
- A. Correct.
Correct. Geofencing uses geographic location data, commonly based on source IP geolocation in cloud and identity platforms, to allow or deny access from defined regions. In this scenario, the attack traffic is coming from countries with no valid business need, so blocking authentication attempts from those regions is an effective first control. It is also consistent with the requirement to reduce attacks quickly without modifying employee devices.
- B. Incorrect.
Incorrect. Disabling GPS on mobile devices does not address authentication attempts coming from malicious source IP addresses on the internet. In enterprise access control, geolocation restrictions are typically enforced at the application, firewall, VPN, or identity-provider level using network location data, not by changing end-user GPS settings.
- C. Incorrect.
Incorrect. Biometrics may strengthen authentication, but this option does not directly address the immediate problem of attack traffic from specific foreign regions and would likely require major user, hardware, and integration changes. The question asks for the BEST first step that can be implemented quickly and without device changes.
- D. Incorrect.
Incorrect. Full-disk encryption protects data at rest on a lost or stolen device. It does not reduce password-spraying attempts against a cloud service from foreign IP addresses. This is a common confusion between endpoint data protection and access-control measures.