Examkin

Question

Difficulty: HardEndpoint Detection and Response (EDR)

During a threat hunting exercise on an enterprise Linux application server hosting a mission-critical web service, a security analyst analyzes host telemetry. While network perimeter security controls inspect traffic as encrypted HTTPS over TCP port 443, the Endpoint Detection and Response (EDR) agent captures a process creation event where the primary web service daemon spawned an unauthorized bash shell, which subsequently loaded an obfuscated binary payload into volatile shared memory (`/dev/shm`). The analyst must halt the active command-and-control (C2) session and eradicate the malicious code execution immediately without causing downtime for legitimate external application users. Which of the following capabilities provided by the EDR platform should the analyst utilize to accomplish this objective?

  1. Perform targeted process-tree termination and executable hash blocking for the spawned shell and memory-resident binary.Answer
  2. B
    Execute a full host-level network isolation command on the server via the EDR management console.
  3. C
    Deploy an egress perimeter firewall blocking rule targeting all outbound connections from the application server subnet.
  4. D
    Initiate a scheduled legacy antivirus disk scan to quarantine static signature matches on the file system.

Answer

Terminating the specific malicious process tree and blocking the binary execution hash directly via the EDR agent isolates the threat while preserving web daemon availability.
Process-tree termination and hash blocking leverages the continuous behavioral telemetry of EDR to target and kill only the rogue child process lineage (`bash` and the `/dev/shm` payload) while keeping the underlying web daemon operational.

Step-by-Step Solution

1
Analyze the process lineage telemetry provided by the EDR host agent.
Identify that the parent web daemon spawned an unauthorized child shell executing a fileless payload in memory.
EDR agents capture continuous kernel-level process relationships that perimeter devices cannot see.
2
Evaluate the operational constraint requiring zero service downtime for legitimate web users.
Rule out host-wide containment actions like full network isolation or host shutdown.
Host network isolation severs all user connections to the web daemon.
3
Apply targeted endpoint mitigation controls.
Kill the spawned bash shell and memory-resident child processes, then apply hash-based block rules in the EDR console.
Process-level termination selectively neutralizes the adversary's C2 channel while keeping the parent service alive.

Key Concept

EDR Fine-Grained Process Containment vs. Host Isolation
Rate this question

Topics

Endpoint Detection and Response (EDR)

More questions from this topic