Examkin

Question

Difficulty: EasyEndpoint Detection and Response (EDR)

A security analyst notices suspicious process execution on a financial department workstation during an active malware outbreak. To immediately block the workstation's network communication with other internal systems while preserving the security team's remote telemetry and control channel, which of the following is the most appropriate action to take?

  1. Perform a network host isolation action through the EDR consoleAnswer
  2. B
    Modify ingress rules on the enterprise border firewall to block internal host traffic
  3. C
    Push an updated signature file to legacy antivirus software on the local subnet
  4. D
    Reassign the host system logging policy to a detective control classification

Answer

Perform a network host isolation action through the EDR console
Executing a host isolation feature via an EDR platform severs all network traffic to and from the targeted workstation except for the encrypted connection between the EDR agent and its management console. This effectively stops lateral movement while enabling continuous incident investigation.

Step-by-Step Solution

1
Identify the primary operational requirement during containment
The goal is to stop lateral movement across internal systems while keeping host telemetry and remote management functional.
Containment must block malicious network traffic without losing control over the compromised endpoint.
2
Evaluate Endpoint Detection and Response (EDR) host isolation capabilities
EDR agents can isolate the endpoint software-wise, restricting network adapters to communicate only with the EDR management console.
This prevents lateral spread while allowing analysts to inspect memory, terminate processes, and gather telemetry.

Key Concept

Endpoint Network Isolation
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic