A SOC analyst observes reconnaissance activity from an IP address.

Vendor: CompTIA
Product: CS0-003
Update on: Feb 7, 2026
Questions: 433

CompTIA CS0-003 Question Answer

A SOC analyst observes reconnaissance activity from an IP address. The activity follows a pattern of short bursts toward a low number of targets. An open-source review shows that the IP has a bad reputation. The perimeter firewall logs indicate the inbound traffic was allowed. The destination hosts are high-value assets with EDR agents installed. Which of the following is the best action for the SOC to take to protect against any further activity from the source IP?

Add the IP address to the EDR deny list.

Create a SIEM signature to trigger on any activity from the source IP subnet detected by the web proxy or firewalls for immediate notification.

Implement a prevention policy for the IP on the WAF

Activate the scan signatures for the IP on the NGFWs.