Examkin

Question

Difficulty: MediumEndpoint Detection and Response (EDR)

A Security Operations Center (SOC) analyst identifies active data exfiltration from a user workstation caused by an unauthorized memory-resident process. The analyst must immediately stop the data egress and restrict lateral network communication while retaining remote console administrative access to collect RAM telemetry and run live response forensic commands. Which of the following capabilities should the analyst execute?

  1. EDR agent host network isolationAnswer
  2. B
    Perimeter firewall egress rule modification
  3. C
    Remote hard power-off command via management interface
  4. D
    Enterprise Group Policy script execution restriction policy deployment

Answer

EDR agent host network isolation isolates the compromised endpoint from all internal and external network communication while preserving the live telemetry management channel for SOC investigation.
The correct answer leverages the EDR agent's native network isolation feature. This places a software boundary around the endpoint host operating system, dropping all incoming and outgoing network traffic except for the encrypted control channel used by security analysts for remote triage and live response.

Step-by-Step Solution

1
Analyze containment requirements
The target system requires immediate network exfiltration blockage without losing volatile forensic data or analyst management connectivity.
Shutting down the host loses RAM evidence, while network-level blocks may not stop internal lateral movement.
2
Evaluate EDR network isolation capability
EDR agents utilize software-defined filtering at the endpoint kernel layer to block all application layer traffic except the agent-to-console management protocol.
This guarantees containment of malicious outbound/east-west traffic while enabling live response activities.

Key Concept

EDR Host Isolation and Live Response Containment
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic