During an ongoing threat hunting investigation within a Linux database cluster, an automated Endpoint Detection and Response (EDR) agent alerts on suspicious ptrace system calls initiating in-memory execution of anonymous memory segments from an unprivileged web server process. To immediately mitigate lateral movement and preserve essential volatile evidence for detailed analysis, which TWO of the following actions should the SOC analyst initiate directly through the EDR management platform? (Select TWO.)
- Enable software-based host network isolation while preserving persistent administrative agent command-and-control channels.Answer
- Trigger remote volatile memory acquisition and endpoint telemetry log collection before terminating suspect process lineages.Answer
- CReconfigure edge network firewall access control lists (ACLs) to drop inbound traffic destined for internal database subnets.
- DDeploy a SOAR playbook that executes an immediate hard system reboot across all cluster nodes upon alert trigger.
Answer
The SOC analyst should enable software-based host network isolation while maintaining EDR agent management connectivity, and trigger remote volatile memory acquisition alongside telemetry log collection before terminating processes.
Enabling host network isolation directly through the EDR agent isolates network adapters to halt lateral movement while preserving the out-of-band management link. Simultaneously acquiring volatile RAM evidence before killing suspect processes ensures forensic artifacts associated with fileless memory injection are retained intact.
Step-by-Step Solution
Key Concept
Endpoint Detection and Response (EDR) Host Containment and Volatile Evidence Preservation