Examkin

Question

Difficulty: EasyEndpoint Detection and Response (EDR)

A system administrator needs to deploy a security control to enterprise endpoints that continuously monitors local host activity, logs process execution lineage, and enables immediate network isolation of compromised devices. Which of the following security solutions best meets these requirements?

  1. Endpoint Detection and Response (EDR)Answer
  2. B
    Stateful Packet Inspection Firewall
  3. C
    Signature-based Antivirus (AV)
  4. D
    Network Intrusion Detection System (NIDS)

Answer

Endpoint Detection and Response (EDR)
Endpoint Detection and Response (EDR) solutions utilize host agents to gather real-time process execution metrics, analyze process trees for anomalous behavior, and provide immediate containment mechanisms such as host-level network isolation.

Step-by-Step Solution

1
Analyze the operational requirements provided in the scenario.
Identified the need for host telemetry logging, process lineage tracking, and automated host isolation.
These controls require an agent running directly on the operating system capable of inspecting system behavior and altering network adapter connectivity.
2
Compare candidate security tools against the required capabilities.
Endpoint Detection and Response (EDR) provides real-time process monitoring, behavioral detection, and automated host isolation features.
EDR specifically expands beyond legacy static signature scanning to capture host execution contexts and enable active incident containment.

Key Concept

Endpoint Detection and Response (EDR) Core Capabilities
Estimated Time:45s
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic