Examkin

Question

Difficulty: MediumEndpoint Detection and Response (EDR)

A security analyst is investigating a stealthy compromise on an enterprise server where an attacker executed an obfuscated script directly in host memory using native tools, avoiding writing any malicious files to the disk. Standard signature-based antivirus software and perimeter firewalls failed to detect the activity. Which capability of Endpoint Detection and Response (EDR) provides the visibility required to identify and trace this fileless execution?

  1. Continuous behavioral monitoring and process parent-child lineage trackingAnswer
  2. B
    Static binary hashing and signature lookup against known malware threat feeds
  3. C
    Deep packet inspection and payload decryption at the perimeter network gateway
  4. D
    Automated host operating system vulnerability scanning and patch deployment

Answer

Continuous behavioral monitoring and process parent-child lineage tracking
The correct answer highlights EDR's ability to monitor ongoing endpoint behavior and process trees in real time. Because fileless attacks execute directly in volatile memory using native system binaries (Living off the Land), traditional static file checks fail. EDR solves this by recording runtime telemetry, including parent-child process chains and command-line parameters.

Step-by-Step Solution

1
Analyze the attack vector described in the scenario
The attack uses fileless execution techniques, relying on memory-resident script execution via native binaries without dropping files to disk.
Understanding that no file was created eliminates static inspection methods that depend on file system artifacts.
2
Evaluate the capabilities of security monitoring technologies against fileless execution
EDR agents maintain continuous telemetry on process creation, memory activity, and execution arguments on host endpoints.
Process lineage tracking enables visibility into abnormal execution flows, such as a legitimate system utility spawning an unexpected command shell.
3
Select the option that specifically addresses host process and memory execution tracking
Continuous behavioral monitoring and process lineage tracking is the core EDR function designed for fileless threat detection.
It captures real-time endpoint behavioral anomalies regardless of file signature presence.

Key Concept

EDR Behavioral Telemetry & Fileless Threat Detection
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic