Examkin

Question

Difficulty: HardEndpoint Detection and Response (EDR)

A tier-2 incident response analyst investigating an alert observes an unknown binary executing child processes that modify critical system registry keys and initiate outbound command-and-control (C2) traffic over non-standard ports on a remote workstation. To immediately prevent lateral movement across the internal subnet while retaining live telemetry, remote command shell access, and memory inspection capability via the agent console, which action should the analyst take?

  1. Initiate agent-based host isolation on the affected endpoint through the EDR platform console.Answer
  2. B
    Terminate the parent binary process and immediately issue a remote system reboot script.
  3. C
    Update perimeter firewall rules to block the remote IP address and non-standard port identified in the alert.
  4. D
    Reclassify the enterprise EDR agent policy setting from a detective control mode to a passive auditing control mode.

Answer

Initiate agent-based host isolation on the affected endpoint through the EDR platform console.
Host isolation implemented directly by the EDR agent restricts all inbound and outbound host network communications except for the dedicated control channel between the agent and the EDR management console. This effectively neutralizes lateral movement and command-and-control communication while preserving volatile RAM state and allowing SOC analysts to run commands, extract memory, and execute playbooks remotely.

Step-by-Step Solution

1
Analyze the incident requirements
The analyst must mitigate lateral movement across the internal network while keeping management channels open for memory investigation and live triage.
Standard network block options kill remote management, while doing nothing permits adversary lateral propagation.
2
Evaluate EDR containment capabilities
Host isolation (also known as endpoint network isolation) cuts off peer-to-peer and general outbound network access on the endpoint while maintaining an encrypted tunnel back to the EDR cloud or management platform.
This specific capability meets both operational demands: isolation from internal assets and continued analyst access.
3
Select the optimal response action
Applying agent-based host isolation fulfills all scenario requirements without destroying volatile system memory state.
It stops lateral movement immediately without requiring physical disconnection or network infrastructure changes.

Key Concept

Endpoint Detection and Response Host Isolation
Estimated Time:2m 0s
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic