Examkin

Question

Difficulty: MediumEndpoint Detection and Response (EDR)

During a routine operational review of corporate laptops, endpoint telemetry detects a malicious script executing directly in volatile memory and initiating unauthorized outbound traffic to a known adversary infrastructure. To stop lateral movement and data exfiltration immediately while retaining live memory context for incident investigation, which of the following EDR capabilities should be executed?

  1. Initiating agent-based network host isolationAnswer
  2. B
    Modifying internal perimeter firewall access control lists (ACLs)
  3. C
    Deploying an emergency static signature update to legacy antivirus software
  4. D
    Applying an operating system patch to mitigate the underlying execution vulnerability

Answer

Initiating agent-based network host isolation is the correct capability because it disconnects the host from the internal network while keeping EDR communication open and preserving volatile memory.
Initiating agent-based network isolation enables security analysts to halt all unauthorized network communications to and from the endpoint instantly while preserving system state and volatile memory for forensic response.

Step-by-Step Solution

1
Identify the immediate incident response priority
Containment is required to halt lateral movement and data exfiltration without losing RAM evidence.
Active fileless memory threats require host containment mechanisms rather than static perimeter blocking.
2
Evaluate EDR containment actions
Agent-based network isolation cuts off non-essential network connections at the host level while maintaining administrative console connectivity.
This allows SOC responders to investigate live memory while preventing the adversary from moving laterally.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic