Examkin

Question

Difficulty: EasyEndpoint Detection and Response (EDR)

A security administrator notices that a host security tool generated an alert for an obfuscated script running directly out of system memory using a built-in operating system utility, despite no known file hashes being flagged. Which of the following capabilities best explains why an Endpoint Detection and Response (EDR) agent can identify this suspicious activity?

  1. Continuous host process monitoring and behavioral telemetry analysisAnswer
  2. B
    Static signature comparisons against cloud database file hashes
  3. C
    In-line edge firewall filtering of incoming network packet payloads
  4. D
    Network-based intrusion prevention system rules matching known exploit signatures

Answer

Continuous host process monitoring and behavioral telemetry analysis allows EDR solutions to detect suspicious, fileless, or memory-based actions even when traditional static signature matching yields no results.
Endpoint Detection and Response (EDR) solutions monitor endpoint activities in real time, gathering telemetry on process execution, system calls, and memory usage. This allows them to spot behavioral anomalies—such as an administrative tool executing obfuscated scripts—regardless of whether a file signature exists.

Step-by-Step Solution

1
Analyze the scenario conditions
The attack involves an obfuscated script executed in memory via built-in system tools with no matching file signatures.
Identifying that no malicious file exists on disk rules out static signature-based detection mechanisms.
2
Evaluate EDR core capabilities
EDR agents continuously collect detailed process interaction, registry, and memory telemetry from the endpoint.
Behavioral analytics inspect runtime actions rather than static file attributes.
3
Select the matching security capability
Continuous host process monitoring and behavioral telemetry analysis is the primary mechanism for detecting living-off-the-land and fileless attacks.
This capability addresses host-level runtime anomalies.

Key Concept

Endpoint Detection and Response (EDR) behavioral monitoring
Estimated Time:45s
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic