Examkin

Question

Difficulty: MediumEndpoint Detection and Response (EDR)

A security analyst monitoring a SOC console receives a high-severity alert from an Endpoint Detection and Response (EDR) agent on an enterprise workstation. The alert details rapid unauthorized file encryption and concurrent attempts at internal lateral movement. Which of the following containment actions should the analyst execute FIRST directly within the EDR console to minimize risk to the enterprise?

  1. Isolate the affected workstation from the network using the EDR agent isolation capability.Answer
  2. B
    Update the perimeter firewall ruleset to block outbound traffic originating from the workstation's IP address.
  3. C
    Reconfigure local host Operating System Access Control Lists (ACLs) to restrict write permissions on user folders.
  4. D
    Initiate an automated full antimalware eradication scan across the host local storage.

Answer

Isolate the affected workstation from the network using the EDR agent isolation capability.
Isolating the host via the EDR console instantly restricts network traffic from the host, preventing the spread of ransomware and lateral movement while maintaining an operational connection between the SOC analyst and the EDR agent for telemetry analysis.

Step-by-Step Solution

1
Analyze the incident response phase requirement.
Determine that the incident is actively progressing (rapid file encryption and lateral movement) and requires immediate containment.
Containment must occur before investigation or eradication to prevent widespread enterprise impact.
2
Select the appropriate EDR feature for host containment.
Execute network isolation via the EDR console interface.
EDR isolation severs host network communications (preventing lateral movement) while maintaining a managed telemetry link for security analysts.

Key Concept

Host Network Isolation in Endpoint Detection and Response
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic