SY0-701 Question 227
Single answerGeolocationA company has moved its payroll application to a cloud-hosted web portal. The security team notices repeated login attempts against employee accounts from countries where the company has no staff, contractors, or business operations. Leadership wants a control that will quickly reduce this attack traffic without requiring changes to employee passwords or the application code. Which of the following is the BEST solution to implement first?
- A
Enable geolocation-based access rules to block or challenge authentication attempts from non-business countries
- B
Disable DNS recursion on the public DNS servers that resolve the payroll application hostname
- C
Require all employees to use longer passwords for the payroll portal
- D
Install a hardware security module (HSM) to protect the payroll application's encryption keys
Show answer and explanation
Correct answer: A
Explanation
The best first step is to use geolocation-based filtering or adaptive access policies to block, deny, or challenge authentication attempts from countries where the organization has no legitimate users. In Security+ terms, geolocation is a practical way to enforce conditional access and reduce exposure to credential attacks, especially when there is a clear business pattern showing where access should and should not originate. This is commonly implemented through identity provider conditional access policies, web application firewalls, secure web gateways, or cloud security controls. As a best practice, geolocation controls should be used carefully because IP-based location can be imperfect, users may travel, and attackers may use VPNs or cloud-hosted infrastructure in allowed regions. For that reason, many organizations combine geolocation with multifactor authentication, impossible-travel detection, risk-based authentication, and logging review. Guidance from major cloud providers and security frameworks commonly supports conditional access and location-based policies as compensating controls for reducing unauthorized access attempts.
- A. Correct.
This is the correct answer. Geolocation-based access rules are specifically designed to restrict or flag traffic based on source geography. In this scenario, the organization has identified authentication attempts from countries with no legitimate business need, so blocking or step-up challenging those locations is an effective compensating control that can be deployed quickly at the identity provider, web application firewall, reverse proxy, or cloud access layer. This aligns with the practical use of geographic restrictions to reduce attack surface and suspicious login activity.
- B. Incorrect.
This is incorrect. Disabling DNS recursion may be a valid hardening step for public-facing DNS infrastructure, but it does not address repeated login attempts from specific countries. The misconception is confusing general infrastructure security improvements with a control that directly mitigates geographically anomalous authentication traffic.
- C. Incorrect.
This is incorrect. Requiring longer passwords could improve overall password strength over time, but it does not immediately stop current login attempts from unwanted regions. It also does not specifically use geolocation, which is the focus of the scenario. Someone might choose this because stronger passwords are a common security recommendation, but they are not the best first control for this particular problem.
- D. Incorrect.
This is incorrect. An HSM helps protect and manage cryptographic keys and can strengthen key security for the application, but it has no direct effect on where login attempts originate. This distractor reflects a common mistake of selecting a strong security technology that is unrelated to the identified threat.