A security analyst detects suspicious fileless PowerShell execution on an enterprise workstation. The analyst needs to use Endpoint Detection and Response (EDR) capabilities to respond to the incident effectively while maintaining investigation capability. Which of the following response actions are primary capabilities provided directly by an EDR platform in this scenario? (Select TWO.)
- Isolating the host from the network logically while maintaining an active agent management channel for remote investigationAnswer
- Capturing real-time host telemetry including process lineage trees, parent-child relationships, and command-line argumentsAnswer
- CReconfiguring core network router access control lists (ACLs) to block outbound subnets
- DBypassing behavioral alerts for traffic originating from the workstation due to its location on an internal VLAN
Answer
The primary EDR capabilities in this scenario are isolating the host from the network while maintaining an administrative agent channel, and collecting continuous host telemetry including process lineage trees and command-line arguments.
Endpoint Detection and Response (EDR) provides granular host isolation to contain suspicious activity without severing the security team's remote management channel. Additionally, EDR continuously collects behavioral telemetry, such as process execution trees and command-line arguments, which allows security analysts to reconstruct attack chains during fileless execution scenarios.
Step-by-Step Solution
Key Concept
Endpoint Detection and Response (EDR) Core Capabilities