Examkin

Question

Difficulty: EasyEndpoint Detection and Response (EDR)

A technician identifies an active malware infection on an enterprise desktop. To stop lateral movement without losing volatile memory evidence, the technician uses the Endpoint Detection and Response (EDR) console. Which of the following capabilities should the technician execute?

  1. Perform host network isolation via the EDR agentAnswer
  2. B
    Apply a perimeter firewall block rule for the infected host IP address
  3. C
    Remotely power off the machine to stop malicious process execution
  4. D
    Enable a detective packet logging filter on the local network switch

Answer

Perform host network isolation via the EDR agent
Performing host network isolation directly through the EDR agent prevents the endpoint from communicating with any local or remote network resources, halting lateral malware propagation while maintaining machine power so security responders can harvest volatile RAM memory.

Step-by-Step Solution

1
Identify the primary operational constraint and goal
The goal is to halt lateral threat movement immediately while preserving volatile system memory (RAM).
Shutting down the host loses volatile evidence, while network-based filtering does not block internal local communication effectively.
2
Evaluate EDR endpoint control capabilities
Host network isolation cuts off all host network interface adapters remotely via the installed EDR agent while keeping system state active.
This isolates the compromised host from the enterprise network without powering down the device.

Key Concept

EDR Host Isolation and Volatile Evidence Preservation
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic