Examkin

Question

Difficulty: Very hardEndpoint Detection and Response (EDR)

An enterprise Security Operations Center (SOC) team is configuring an automated playbook within their Endpoint Detection and Response (EDR) solution to respond to an active ransomware outbreak involving credential dumping and process injection. Place the incident response steps in the correct operational order from initial containment through complete host restoration.

  1. 1Apply software-defined host network isolation via the EDR agent driver while maintaining the management telemetry channel.
  2. 2Perform a remote volatile memory (RAM) and process memory capture on the isolated endpoint.
  3. 3Terminate the compromised process tree and invalidate associated compromised user tokens.
  4. 4Publish extracted file hashes and command-and-control (C2) domain indicators to enterprise-wide EDR block rules.
  5. 5Restore compromised system files from a known good baseline and re-enable standard network adapter connectivity.

Answer

The proper operational sequence begins with network isolation via the EDR agent, followed by volatile memory collection, process tree termination and token revocation, enterprise-wide IOC block rule propagation, and finally system integrity remediation prior to network restoration.
The correct sequence prioritizes halting threat spread first through EDR agent network isolation, preserving perishable volatile memory next before process termination, killing active malicious code execution third, deploying global block rules to protect other network assets fourth, and finally cleaning host artifacts before restoring network connectivity.

Step-by-Step Solution

1
Isolate the endpoint network connection via EDR software filters.
Halts lateral spread and data exfiltration instantly while keeping EDR communication open.
Immediate containment is mandatory prior to evidence collection or termination.
2
Acquire volatile memory image (RAM capture).
Preserves volatile injected DLLs, unwritten encryption keys, and active process handles.
Terminating malicious processes prior to memory capture permanently destroys critical forensic artifacts.
3
Kill malicious process tree and revoke associated session credentials.
Stops threat execution on the endpoint.
Active threat execution must be halted once volatile forensic data is secured.
4
Propagate newly identified file hashes and network indicators to the global EDR tenant block list.
Protects all uncompromised endpoints across the organization.
Global containment prevents lateral reinfection across non-isolated endpoints.
5
Remediate modified system binaries, verify baseline integrity, and remove host network isolation.
Returns the endpoint safely to normal operational status.
Host un-isolation should only occur after complete cleanup and integrity verification.

Key Concept

EDR Incident Response Playbook Sequencing
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic