An organization is experiencing multiple instances of attempted access from geographicallocations where there are no...

Geo-IP filtering at the firewallis a well-established method of blocking traffic from regions that the organization does not do business with or has no legitimate presence in.

NIST SP 800-41 Rev. 1 (Guidelines on Firewalls):

“Firewalls can be configured to block traffic based on geolocation or IP ranges to reduce exposure to known hostile regions.”

Firewalls are thefirst line of defensein the network perimeter; adjusting SIEM rules doesn’t actively block access.

????WGU Course Alignment:

Domain:Network Security

Topic:Implement firewall filtering rules for geographic and IP-based restrictions