Examkin

Question

Difficulty: HardEndpoint Detection and Response (EDR)

During a threat monitoring shift, a security analyst receives an alert indicating that a built-in operating system binary (`mshta.exe`) executed an unencoded command shell directly in system memory and initiated an encrypted outbound connection to an unknown external IP address. A traditional signature-based antivirus scan on the host reports no infected files on disk. Which capability of an Endpoint Detection and Response (EDR) solution enabled the detection of this activity, and what is the most appropriate initial containment action?

  1. Behavioral telemetry monitoring of process interactions; isolate the affected host from the network using the EDR management console.Answer
  2. B
    Static file signature matching against known malware hashes; perform an immediate full-disk antimalware scan to quarantine the malicious binary.
  3. C
    Perimeter network firewall inspection of application traffic; update the edge firewall rules to block the external IP address.
  4. D
    Subnet microsegmentation based on implicit zone trust; reconfigure switch VLAN settings to disconnect the host's local network segment.

Answer

Behavioral telemetry monitoring of process interactions allows the EDR system to detect fileless execution of legitimate system binaries in RAM, and software-level host isolation via the EDR console is the immediate containment action.
Behavioral telemetry monitoring tracks runtime behavior and anomalous process chains, enabling EDR tools to flag living-off-the-land attacks where native binaries behave maliciously. Performing software-level host isolation directly through the EDR console prevents lateral spread across the network while maintaining the control channel required for incident investigation.

Step-by-Step Solution

1
Analyze the alert context and execution vector
The attack utilizes a native system binary (`mshta.exe`) running malicious code in memory without dropping files to disk, bypassing static hash-based detection.
Living-off-the-land (LotL) and fileless techniques require continuous behavioral telemetry inspection rather than traditional file scanning.
2
Identify the core EDR detection mechanism
Behavioral telemetry monitoring captures anomalous process behavior, such as a dual-purpose system tool spawning a shell and establishing outbound sockets.
EDR agents monitor API calls, process lineage, and behavioral anomalies continuously.
3
Determine the proper incident containment response
Initiate software-based host network isolation via the EDR agent console.
Host isolation blocks internal network communications to prevent lateral movement while keeping the EDR agent connected for forensic analysis.

Key Concept

Endpoint Detection and Response (EDR) Behavioral Monitoring and Host Isolation
Estimated Time:2m 0s
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic