Examkin

Question

Difficulty: Very hardEndpoint Detection and Response (EDR)

An enterprise Security Operations Center (SOC) analyst receives an advanced Endpoint Detection and Response (EDR) behavioral alert indicating process hollowing on a critical database server. Telemetry reveals a legitimate system binary was spawned in a suspended state, injected with code, and resumed to establish an encrypted outbound channel. Which of the following actions should the analyst perform directly through the EDR platform to manage this incident while preserving evidentiary integrity? (Select TWO.)

  1. Apply host-level network isolation through the EDR agent while maintaining the platform's control channel.Answer
  2. B
    Update edge perimeter firewall rules to block external network traffic destined for the malicious IP address.
  3. Initiate a volatile memory capture via the EDR agent before terminating the hollowed process.Answer
  4. D
    Issue a remote command to immediately reboot the host into Safe Mode to purge active malicious memory structures.

Answer

The analyst should isolate the host using host-level network isolation via the EDR agent and capture volatile memory before terminating the hollowed process.
Applying host-level network isolation via EDR stops outbound command-and-control channels and internal lateral movement while keeping the security agent online. Capturing volatile memory before process termination ensures the analyst captures injected memory regions, unpacked code binaries, and network connection artifacts needed for complete forensic investigation.

Step-by-Step Solution

1
Isolate the compromised host from the network using host-level EDR capabilities.
The target machine is restricted from communicating with lateral endpoints or external C2 servers while maintaining active administrative communication with the EDR server.
Host-level isolation prevents malicious network propagation while preserving analyst command capability.
2
Trigger a remote RAM acquisition via EDR telemetry functions prior to remediation.
Unencrypted payload data, hollowed memory space, and active socket information are securely captured into a forensic memory image.
Volatile memory contains critical threat indicators that are permanently lost if the process is killed or the machine is restarted.
3
Proceed with targeted process termination and threat eradication workflows.
The injected code execution is stopped, and post-forensic remediation playbooks can safely run.
Eradication must occur only after containment and volatile forensic acquisition are established.

Key Concept

Endpoint Detection and Response (EDR) Containment and Evidence Preservation Workflow
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic