Examkin

Question

Difficulty: EasyEndpoint Detection and Response (EDR)

A security team is defining an automated containment and investigation workflow for suspicious host behavior flagged by an Endpoint Detection and Response (EDR) agent. Order the steps in the correct chronological sequence from initial detection through remediation.

  1. 1The EDR sensor detects anomalous process behavior on an endpoint.
  2. 2An automated playbook executes host isolation to prevent lateral movement.
  3. 3A SOC analyst examines the endpoint telemetry logs and process tree execution paths.
  4. 4Forensic artifacts and volatile memory dumps are collected from the isolated host.
  5. 5Newly identified indicators of compromise (IoCs) are deployed to enterprise security controls.

Answer

The correct sequence of the EDR incident response workflow is: (1) EDR sensor detects anomalous process behavior, (2) Automated playbook executes host isolation, (3) SOC analyst examines telemetry logs and process tree, (4) Forensic artifacts and memory dumps are collected, and (5) Newly identified IoCs are deployed to security controls.
The workflow follows standard incident response phases tailored to EDR functionality: Detection (EDR agent alerts on process anomaly) -> Containment (automated network isolation) -> Analysis (SOC analyst investigates process lineage) -> Investigation/Forensics (memory dump and artifact extraction) -> Remediation/Post-Incident (distributing IoCs enterprise-wide).

Step-by-Step Solution

1
Identify the event triggering the incident response sequence.
The EDR sensor identifies suspicious activity on the local endpoint.
Detection is the prerequisite step that triggers automated playbooks and alerts.
2
Contain the threat automatically using EDR capabilities.
Network interface of the affected host is isolated from the rest of the enterprise network.
Immediate containment limits blast radius and prevents lateral movement while preserving management access for EDR control.
3
Perform preliminary investigation of endpoint telemetry.
Analyst inspects process lineage, command-line arguments, and parent-child relationships.
Investigating telemetry confirms whether the alert is a true positive and pinpoints attacker tactics.
4
Collect deep forensic evidence.
Volatile memory and system triage packages are acquired from the isolated endpoint.
Detailed forensic collection supplies evidence for root-cause analysis and malware analysis.
5
Remediate and update organizational security posture.
Extracted IoCs are added to SIEM, firewalls, and EDR detection rules.
Feedback into security infrastructure prevents duplicate compromise across other enterprise endpoints.

Key Concept

Endpoint Detection and Response (EDR) Automated Containment and Incident Investigation Workflow
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic