Examkin

Question

Difficulty: Very hardEndpoint Detection and Response (EDR)

During an active threat triage, telemetry from a critical workstation's Endpoint Detection and Response (EDR) agent alerts to suspicious memory modifications. An unprivileged process performed memory injection into a legitimate system binary using direct Native API system calls, bypassing user-mode API hooks. The rogue process has created an unbacked memory region executing stealthy code, but no outbound command-and-control (C2) network sockets have been established yet. Which action should the security analyst take FIRST via the EDR platform to mitigate risk without destroying essential volatile forensic evidence?

  1. Enable network-level host isolation through the EDR console while keeping the agent communication tunnel active.Answer
  2. B
    Execute an aggressive remote agent command to forcibly terminate the parent system process tree.
  3. C
    Update the perimeter gateway firewall rules to block inbound and outbound traffic for the endpoint's IP address.
  4. D
    Push a legacy signature update package to the endpoint and initiate a full disk antivirus scan.

Answer

Enable network-level host isolation through the EDR console while keeping the agent communication tunnel active.
Enabling network-level host isolation via the EDR agent isolates the host from all network communication (except the secure EDR management channel). This prevents any impending C2 connections or internal lateral movement while maintaining system power and process states so security analysts can capture volatile RAM evidence.

Step-by-Step Solution

1
Analyze threat context
Identified an active fileless in-memory process injection attack bypassing API hooks.
Understanding that the payload resides strictly in volatile memory dictates that host shutdown or process termination will destroy key forensic artifacts.
2
Evaluate containment options against forensic preservation requirements
Selecting EDR host isolation isolates the network adapter driver without killing processes or restarting the machine.
Host isolation breaks potential network paths to prevent lateral movement or C2 calls while keeping the host active for volatile RAM acquisition.
3
Execute immediate response action
Containment is applied instantly via the EDR control plane.
Agent-side network driver isolation takes effect instantly across all network interfaces, including internal LAN subnets.

Key Concept

EDR Host Isolation and Volatile Evidence Preservation
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic