Examkin

Question

Difficulty: MediumEndpoint Detection and Response (EDR)

An organization is deploying an Endpoint Detection and Response (EDR) agent across its fleet of enterprise workstations to enhance host-level threat detection and incident containment capabilities. Which of the following represent core operational features provided by an EDR solution? (Select TWO.)

  1. Continuous host telemetry collection and behavioral monitoring of active processes, registry changes, and memory executionsAnswer
  2. Automated host network isolation to stop lateral movement upon high-confidence threat detectionAnswer
  3. C
    Inline deep packet inspection and traffic filtering at the network edge perimeter
  4. D
    Scheduled batch disk scanning based exclusively on daily downloaded static file signature definitions

Answer

The correct answers are the continuous host telemetry collection and behavioral monitoring of active processes, registry changes, and memory executions, along with automated host network isolation to stop lateral movement upon high-confidence threat detection.
Endpoint Detection and Response (EDR) agents provide continuous visibility into host activity by recording behavioral telemetry (process creation, file writes, network sockets, memory allocation) and support active response mechanisms like automated endpoint isolation to mitigate malicious lateral movement.

Step-by-Step Solution

1
Identify the primary scope of Endpoint Detection and Response (EDR) technology.
EDR focuses specifically on host-level security observability, behavioral telemetry, continuous recording of system events, and proactive containment.
Understanding the boundary between endpoint monitoring and network/perimeter controls helps isolate valid EDR features.
2
Evaluate options offering continuous monitoring and automated containment.
Real-time process telemetry logging and automated network isolation of compromised host devices are standard EDR functions.
EDR replaces legacy signature-only scanning with continuous monitoring and automated playbooks for incident containment.
3
Differentiate EDR from network perimeter controls and legacy signature-based antivirus.
Edge traffic inspection belongs to network firewalls/IPS, while signature-based batch disk scanning characterizes legacy antivirus.
EDR operates on the endpoint itself using behavioral monitoring rather than relying on perimeter filtering or static signatures.

Key Concept

Core capabilities of Endpoint Detection and Response (EDR)
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic