Examkin

Question

Difficulty: MediumEndpoint Detection and Response (EDR)

Following a phishing simulation report, a security analyst reviews telemetry to identify systems where an unauthorized script executed via a native administrative tool without creating new executable files on disk. Traditional signature-based antivirus on the endpoints flagged no alerts. Which of the following Endpoint Detection and Response (EDR) capabilities allows the analyst to identify this activity?

  1. Process lineage tracking and behavioral telemetry collectionAnswer
  2. B
    Static file signature updates pushed from a central management console
  3. C
    Perimeter firewall packet inspection and network rule adjustments
  4. D
    Operating system mandatory access control enforcement

Answer

Process lineage tracking and behavioral telemetry collection
Process lineage tracking and behavioral telemetry collection allow EDR solutions to monitor process creation events, command-line arguments, and parent-child execution hierarchies. This enables analysts to spot suspicious activity, such as legitimate system binaries executing unusual commands, even when no malware binary is written to the disk.

Step-by-Step Solution

1
Analyze the incident context and attack vector.
Identified a fileless attack where native system binaries execute malicious scripts without saving new files to disk.
Traditional antivirus fails to detect this activity because no known malicious file signature is created on the filesystem.
2
Evaluate the required security capability to detect fileless activity.
Determined that monitoring runtime execution logic, parent-child process chains, and system behavior is necessary.
Fileless threats rely on legitimate binaries, requiring context-aware behavioral inspection rather than static file hash matching.
3
Select the EDR feature that provides this monitoring capability.
Process lineage tracking and behavioral telemetry collection.
EDR records the relationships between parent and child processes (such as a word processor launching a command shell), capturing anomalous behavior across endpoints.

Key Concept

Endpoint Detection and Response (EDR) behavioral telemetry and process lineage
Estimated Time:1m 30s
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic