A financial systems workstation triggers a high-fidelity telemetry alert on an Endpoint Detection and Response (EDR) dashboard when a suspicious process attempts code injection into `explorer.exe` to establish a reverse connection. Which of the following initial actions should the incident response team perform using the EDR platform? (Select TWO.)
- Apply host-level network isolation to the endpoint using the agent software to terminate active command-and-control channels while retaining management connectivity.Answer
- BReconfigure perimeter firewall rules to block internal traffic between local workstation subnets.
- Initiate a volatile memory capture directly through the agent console before altering host process state.Answer
- DDeploy an automated OS re-image script immediately across the endpoint host to ensure total malware eradication.
Answer
The incident response team should apply host-level network isolation using the EDR agent software and initiate a volatile memory capture prior to altering host process states.
Endpoint Detection and Response (EDR) solutions provide granular control directly on target hosts. Applying host network isolation limits malicious lateral movement and C2 traffic while preserving the administrator's remote console access. Furthermore, executing a remote RAM capture prior to process containment safeguards volatile evidence necessary for root-cause memory forensics.
Step-by-Step Solution
Key Concept
EDR Host Containment and Volatile Telemetry Collection
Estimated Time:1m 30s