Examkin

Question

Difficulty: MediumEndpoint Detection and Response (EDR)

A security analyst receives a high-fidelity Endpoint Detection and Response (EDR) alert indicating that a web service process on a critical Linux server is executing unauthorized shell commands and attempting outbound command-and-control communications. The analyst must contain the threat immediately to prevent lateral movement while preserving volatile memory and maintaining an administrative management channel to the host. Which of the following is the most appropriate action to take using the EDR console?

  1. Execute host isolation to restrict network traffic while maintaining the EDR management agent connection.Answer
  2. B
    Modify perimeter firewall access control lists (ACLs) to drop all inbound and outbound IP traffic for the server.
  3. C
    Issue a remote force restart command to reboot the Linux host and clear malicious running processes.
  4. D
    Trigger an immediate legacy antivirus full-system disk scan across all storage volumes on the target server.

Answer

Execute host isolation to restrict network traffic while maintaining the EDR management agent connection.
Executing host isolation via the EDR platform selectively blocks network traffic at the endpoint level while keeping the secure agent-to-console communications channel open. This isolates the compromised system from internal and external network assets to prevent lateral movement, while preserving volatile memory (RAM) and allowing security analysts to conduct remote containment and investigation actions.

Step-by-Step Solution

1
Identify the primary operational requirement based on the incident scenario.
The requirement is immediate active containment of malicious C2 communication and lateral movement on an endpoint without destroying volatile memory or losing analyst control.
Incident response containment actions must prioritize stopping attack spread while preserving forensic evidence.
2
Evaluate the native containment capabilities of Endpoint Detection and Response (EDR) platforms.
EDR host isolation segregates the endpoint software network stack at the kernel/agent level, allowing only EDR agent telemetry and control traffic to pass back to the management platform.
Host network isolation immediately cuts off attacker C2 channels and lateral probing without powering down the host or altering volatile memory state.
3
Compare host network isolation against alternative actions such as perimeter blocking, rebooting, or signature scanning.
Perimeter firewalls do not stop internal lateral movement, rebooting destroys volatile RAM evidence, and legacy AV scans do not actively isolate the compromised network socket.
Host isolation via the EDR console is the only action that fulfills all scenario requirements.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic