Examkin

Question

Difficulty: HardEndpoint Detection and Response (EDR)

A Security Operations Center (SOC) team is responding to a high-severity Endpoint Detection and Response (EDR) alert on a Linux server hosting critical API microservices. Telemetry indicates an adversary attempted to load an unsigned rootkit kernel module via the `init_module` system call while disabling the local `auditd` daemon. Which of the following initial containment and forensic actions should be executed to halt potential threat activity while preserving crucial digital evidence? (Select TWO.)

  1. Apply software-level host isolation via the EDR agent interface to cut endpoint communication while preserving the agent management tunnel.Answer
  2. Trigger an automated volatile memory capture (RAM dump) on the system before terminating suspicious processes or restarting host services.Answer
  3. C
    Reconfigure perimeter network firewalls to block all inbound traffic targeted at the server's public IP address.
  4. D
    Send a remote hard-reboot signal to flush the unverified kernel module and reset system memory to a known baseline.

Answer

The correct response actions are applying software-level host isolation through the EDR management plane and initiating a volatile memory capture before executing process termination or host resets.
The correct measures involve isolating the host using the EDR agent's software control features and capturing volatile memory (RAM) before taking invasive recovery actions. Host isolation via EDR restricts network access to stop lateral movement while preserving the out-of-band agent communication link required for investigation. Capturing RAM preserves volatile kernel-mode artifacts and active memory structures necessary for rootkit forensic analysis.

Step-by-Step Solution

1
Evaluate the immediate threat posed by kernel-level tampering and potential lateral movement.
Identify that network isolation is required immediately to restrict adversary activity.
Kernel module manipulation indicates root-level access; network isolation prevents lateral propagation across adjacent API microservices.
2
Select the appropriate isolation mechanism that maintains security analyst management capabilities.
EDR agent host isolation severing non-management traffic.
Agent-based isolation blocks unauthorized network traffic while retaining the telemetry and remote shell capabilities of the EDR tool.
3
Prioritize digital evidence preservation according to the order of volatility.
Perform a volatile memory capture prior to host reboot or process termination.
Kernel modules and memory-resident rootkits reside in volatile system RAM and must be captured before rebooting or clearing process states.

Key Concept

EDR Host Containment & Volatile Evidence Preservation Workflow
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic