Examkin

Question

Difficulty: MediumEndpoint Detection and Response (EDR)

A Security Operations Center (SOC) analyst receives an Endpoint Detection and Response (EDR) telemetry alert indicating a malicious DLL side-loading attempt on an enterprise domain controller. Arrange the standard EDR incident response steps in the correct chronological order from first to last.

  1. 1Detect and flag the behavioral anomaly via the EDR agent's process monitoring telemetry.
  2. 2Apply host-level network isolation through the EDR console while keeping agent management communication open.
  3. 3Collect volatile memory snapshots and execution logs remotely using the EDR agent.
  4. 4Terminate the malicious process tree, remove persistence registry keys, and restore network connectivity.

Answer

The correct sequence of actions is: 1) Detect and flag the behavioral anomaly via EDR telemetry, 2) Apply host-level network isolation, 3) Collect volatile memory snapshots and execution logs, and 4) Terminate malicious processes, remove persistence keys, and restore network connectivity.
The correct order follows the standard incident containment life cycle: telemetry detection identifies the threat, host isolation immediately contains lateral movement while maintaining EDR management channels, forensic collection gathers volatile evidence safely, and remediation cleans the system before network restoration.

Step-by-Step Solution

1
Identify threat activity using EDR behavioral monitoring telemetry
Alert generated for unauthorized process execution and side-loading
Detection provides the necessary diagnostic context to initiate incident response.
2
Isolate the endpoint using host-level network containment
Host is logically disconnected from the network while preserving EDR control
Containing the host mitigates lateral spread and C2 communication immediately.
3
Gather forensic artifacts and volatile memory captures via EDR console
Volatile evidence is preserved without risking network exposure
Collecting triage data while isolated ensures evidence is captured prior to system modification.
4
Remediate threat artifacts and lift host network isolation
Rogue processes killed, persistence removed, and endpoint restored to normal operations
Remediation and un-isolation conclude the active containment and response lifecycle.

Key Concept

EDR automated containment and forensic investigation workflow
Estimated Time:1m 30s
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic