Examkin

Question

Difficulty: MediumEndpoint Detection and Response (EDR)

An analyst is defining an automated incident response playbook within an Endpoint Detection and Response (EDR) system to handle high-severity malware execution alerts on enterprise workstations. Place the following steps of the automated containment, analysis, and recovery workflow in the correct chronological order from first to last.

  1. 1Isolate the endpoint from the enterprise network via the EDR control plane while maintaining agent communications.
  2. 2Terminate the malicious process tree and associated memory-injected threads on the endpoint.
  3. 3Collect volatile memory artifacts and process execution telemetry for root-cause forensic analysis.
  4. 4Revoke the host network isolation rule to restore standard network access after system remediation.

Answer

The correct sequence for the EDR response workflow begins with isolating the endpoint from the network, followed by terminating the malicious processes, gathering volatile memory telemetry for forensic analysis, and finally lifting network isolation after remediation.
The correct response order follows standard incident handling best practices in EDR environments: immediate network containment to prevent lateral movement, termination of malicious processes to stop active damage, acquisition of telemetry and forensics to analyze attack vectors, and host network restoration after remediation is confirmed.

Step-by-Step Solution

1
Perform immediate host isolation via EDR capabilities.
The endpoint is blocked from communicating with local network resources and external command-and-control servers while retaining EDR management connectivity.
Containment is the primary initial operational priority to restrict the attack blast radius without disrupting SOC control.
2
Terminate active threat processes.
Malicious process trees and memory-injected code execution are halted on the local host.
Stopping active malicious code prevents ongoing unauthorized actions, such as ransomware encryption or local credential harvesting.
3
Gather forensic telemetry and volatile memory artifacts.
Detailed process lineages, network sockets, and memory dumps are collected for SOC investigation.
Investigating telemetry determines the attack vector and identifies persistence mechanisms established prior to host isolation.
4
Lift host isolation and restore connectivity.
The host resumes standard enterprise network communications.
Network access should only be restored after confirming the host is completely remediated and secure.

Key Concept

EDR Automated Containment and Remediation Workflow
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic