Examkin

Question

Difficulty: MediumEndpoint Detection and Response (EDR)

A security analyst monitoring a Linux web server notices an alert indicating an unauthorized process was spawned in memory following a web application exploit. The process is actively attempting to establish outbound command-and-control (C2) communication. To minimize impact, the security analyst must stop the adversary's lateral movement and communication immediately without powering down the host or losing volatile RAM evidence. Which of the following EDR features best fulfills this requirement?

  1. Initiating agent-based network isolation on the host to sever non-management network traffic while leaving the endpoint powered onAnswer
  2. B
    Updating edge perimeter firewall access control lists to block incoming HTTP requests to the web server
  3. C
    Pushing updated static antivirus hash signatures to quarantine the malicious binary on disk
  4. D
    Creating manual iptables host firewall rules on the compromised server to block the destination C2 port

Answer

Initiating agent-based network isolation on the host to sever non-management network traffic while leaving the endpoint powered on is the correct action.
The correct answer leverages EDR agent host network isolation. This capability restricts network traffic at the endpoint driver level, blocking all unauthorized inbound and outbound network connections while maintaining a secure management tunnel for security analysts to collect forensic artifacts such as volatile memory (RAM).

Step-by-Step Solution

1
Identify the primary incident response containment objective.
The endpoint must be restricted from communicating outbound or laterally without destroying volatile evidence stored in RAM.
Shutting down or rebooting the server destroys critical forensic memory artifacts.
2
Evaluate EDR capabilities against legacy or network-level controls.
EDR host network isolation isolates the operating system at the software driver layer while maintaining agent telemetry management connectivity.
This allows remote analysts to perform containment instantly and collect volatile memory without allowing the attacker to navigate laterally.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation
Estimated Time:1m 30s
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic