Examkin

Question

Difficulty: HardEndpoint Detection and Response (EDR)

During an operational security review, a SOC analyst identifies an unprivileged service account launching an encoded command that executes process hollowing against svchost.exe on a core database host. The analyst needs to stop active adversary command-and-control (C2) communication and prevent lateral movement immediately, while ensuring volatile memory (RAM) remains intact for live memory forensic extraction. Which of the following actions should the analyst execute FIRST using the EDR platform?

  1. Execute host-level network isolation via the EDR console to block system network traffic while preserving the EDR agent management channel.Answer
  2. B
    Reboot the database host into safe mode to terminate malicious memory space allocations and clear the hollowed process.
  3. C
    Modify perimeter firewall ACLs to block outbound port 443 connections originating from the database server subnet.
  4. D
    Push an updated signature definition package to legacy antivirus software installed on the database server.

Answer

Execute host-level network isolation via the EDR console to block system network traffic while preserving the EDR agent management channel.
Executing host-level network isolation via the EDR agent console immediately restricts all incoming and outgoing network traffic at the host network driver level, neutralizing command-and-control (C2) channels and blocking lateral movement. Crucially, the EDR console maintains an encrypted management tunnel to the host agent, allowing analysts to perform live incident response, pull volatile RAM images, and run forensic scripts while keeping the host powered on.

Step-by-Step Solution

1
Analyze the incident requirements and constraints
Identified the need for immediate containment of C2 and lateral movement while preserving volatile memory (RAM).
Process hollowing resides in system memory; restarting or powering down host destroys volatile evidence.
2
Evaluate EDR containment capabilities against legacy controls
Determined that EDR host-level network isolation disables network adapters logically without interrupting agent-to-console management.
This maintains analyst access for RAM acquisition and response playbooks while cutting off the adversary completely.
3
Select the correct initial operational step
Host isolation via the EDR console is the best initial response action.
It satisfies containment objectives without violating the order of volatility in digital forensics.

Key Concept

EDR Endpoint Network Isolation and Forensic Volatility Preservation
Estimated Time:1m 30s
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic