Examkin

Question

Difficulty: Very hardEndpoint Detection and Response (EDR)

During a threat hunting operation on a dual-homed critical enterprise jump server running Windows Server, a SOC analyst identifies suspicious memory-only reflective DLL injection into a legitimate system process. Telemetry shows the process initiating beaconing over an encrypted channel to an unknown external IP address while simultaneously maintaining active RPC session handles to adjacent internal database servers. Which of the following containment actions should the security analyst perform using the Endpoint Detection and Response (EDR) agent to stop lateral movement without losing volatile memory evidence or breaking analyst access?

  1. Initiate host isolation via the EDR console to block non-security network traffic while maintaining the agent telemetry channel.Answer
  2. B
    Reconfigure perimeter edge firewall rules to drop all traffic targeting the jump server and trigger an immediate remote system reboot.
  3. C
    Apply standard legacy antivirus signature updates and rely on perimeter network segment filters to prevent further unauthorized access.
  4. D
    Execute a global SOAR script to drop the jump server's entire VLAN at the core network switch level.

Answer

Initiate host isolation via the EDR console to block non-security network traffic while maintaining the agent telemetry channel.
The correct option correctly identifies the primary containment feature of EDR solutions: host isolation. EDR software agents manipulate kernel-level network filters to isolate the endpoint from all local and remote endpoints except for the designated EDR management console IPs. This halts external command-and-control (C2) beaconing and internal RPC-based lateral movement while keeping the system powered on so analysts can remotely capture volatile memory and inspect process lineage.

Step-by-Step Solution

1
Analyze the threat scenario and containment requirements.
Identified fileless memory-only malware attempting active lateral movement via RPC while beaconing out.
The system contains volatile evidence in RAM that must be preserved for forensic acquisition while immediately halting network communications.
2
Evaluate EDR network isolation capabilities against traditional network/system controls.
EDR host isolation applies software-defined filtering at the endpoint NDIS/kernel layer, severing peer-to-peer and outbound network channels.
This leaves the encrypted EDR agent management tunnel intact so responders can perform remote memory dumps and endpoint triage without physical host access or rebooting.
3
Select the optimal action adhering to incident response standards.
Enact endpoint isolation through the EDR console.
This stops C2 activity and internal lateral movement instantaneously while maintaining volatility preservation standards.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation and Telemetry Preservation
Estimated Time:2m 0s
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic