Examkin

Question

Difficulty: Very hardEndpoint Detection and Response (EDR)

During an investigation into a ransomware propagation attempt on a critical enterprise server, a security analyst reviews telemetry captured by an Endpoint Detection and Response (EDR) agent. The EDR telemetry log reveals that an authenticated enterprise database daemon spawned a command-line interpreter, which subsequently executed `vssadmin.exe delete shadows /all /quiet`. The EDR agent's automated response policy immediately terminated the command interpreter and its child sub-processes and placed the endpoint into network isolation, but deliberately allowed the primary database daemon process to continue executing. Which of the following best explains the architectural rationale behind the EDR agent targeting only the child process tree during remediation?

  1. The EDR agent relies on process lineage and parent-child telemetry correlation to surgically terminate malicious execution contexts while maintaining essential host service uptime.Answer
  2. B
    The EDR agent lacked operating system kernel-level privileges to terminate processes running under service account contexts.
  3. C
    Enforcing host network isolation automatically restores modified storage snapshots, eliminating the need to kill the parent process.
  4. D
    Perimeter firewalls intercepted the volume shadow copy deletion request before the command reached the local operating system kernel.

Answer

The EDR agent relies on process lineage and parent-child telemetry correlation to surgically terminate malicious execution contexts while maintaining essential host service uptime.
The correct answer emphasizes how EDR agents continuously record process creation lineage, maintaining parent-child process relationships. By correlating telemetry across process trees, the EDR agent's behavioral engine can surgically kill malicious child processes (such as a command shell attempting shadow copy deletion) while keeping critical parent enterprise applications running to prevent unnecessary downtime.

Step-by-Step Solution

1
Analyze the EDR telemetry context and process hierarchy described in the scenario.
The parent process (database daemon) is a legitimate enterprise service, while the child process (command interpreter invoking vssadmin.exe) represents malicious activity.
Identifying process tree relationships is critical to understanding how EDR sensors differentiate between normal application behavior and spawned malicious commands.
2
Evaluate EDR remediation capabilities and automated playbook logic.
EDR sensors track parent-child process IDs (PPID/PID) to kill specific process sub-trees selectively.
Surgical termination prevents full endpoint service disruption while still neutralizing malicious execution threads.
3
Differentiate EDR host-based capabilities from wrong control assumptions (privilege limits, network isolation scope, boundary controls).
EDR sensors operate with elevated privileges and perform host-level process termination independent of network boundary firewalls or data recovery routines.
Kernel-level endpoint monitoring guarantees process control, making targeted termination a deliberate design choice for system availability.

Key Concept

EDR Process Lineage Analysis and Targeted Remediation
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic