Examkin

Question

Difficulty: HardEndpoint Detection and Response (EDR)

A tier 2 incident responder analyzing endpoint telemetry observes an active fileless attack on an enterprise financial server, where an injected process is issuing unauthorized API calls to extract credentials and establish an outbound encrypted beacon. To effectively contain the active compromise and preserve critical evidence for incident triage without losing agent telemetry, which of the following response actions should the responder perform using EDR agent capabilities? (Select TWO.)

  1. Apply host-level network isolation via the agent while maintaining the agent-to-console management connectionAnswer
  2. Capture a live volatile memory (RAM) dump of the endpoint directly through agent execution capabilities prior to terminating the suspicious process treeAnswer
  3. C
    Reconfigure edge firewall rules to block the destination C2 IP address across the entire subnetwork
  4. D
    Push an updated static antivirus signature definition file to the host and initiate a full disk quarantine scan

Answer

The incident responder should apply host-level network isolation via the EDR agent while maintaining console connectivity, and capture a live volatile memory (RAM) dump of the host before terminating the suspicious process tree.
Combining host-level agent isolation with pre-remediation volatile memory acquisition enables incident responders to contain active network activity instantly while preserving volatile evidence necessary for root cause analysis.

Step-by-Step Solution

1
Isolate the compromised host at the endpoint layer via EDR console network containment features.
Network communication to external adversary infrastructure and adjacent internal network hosts is severed, stopping lateral movement while preserving SOC remote agent control.
Immediate containment at the host level prevents adversary expansion without blinding the security team.
2
Trigger volatile memory acquisition using EDR forensic capabilities prior to process kill execution.
In-memory code, injected DLLs, and volatile runtime evidence are preserved on disk or uploaded securely for forensic analysis.
Fileless memory threats disappear as soon as the host reboots or the process tree is killed.

Key Concept

EDR Host Isolation and Volatile Telemetry Preservation
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic