Examkin

Endpoint Detection and Response (EDR)

71 questions

All types71Multiple choice36Multiple select16Ordering19
Question 1Question →

During an operational security review, a SOC analyst identifies an unprivileged service account launching an encoded command that executes process hollowing against svchost.exe on a core database host. The analyst needs to stop active adversary command-and-control (C2) communication and prevent lateral movement immediately, while ensuring volatile memory (RAM) remains intact for live memory forensic extraction. Which of the following actions should the analyst execute FIRST using the EDR platform?

Show answer & explanation

Answer: Execute host-level network isolation via the EDR console to block system network traffic while preserving the EDR agent management channel.

Answer

Execute host-level network isolation via the EDR console to block system network traffic while preserving the EDR agent management channel.
Executing host-level network isolation via the EDR agent console immediately restricts all incoming and outgoing network traffic at the host network driver level, neutralizing command-and-control (C2) channels and blocking lateral movement. Crucially, the EDR console maintains an encrypted management tunnel to the host agent, allowing analysts to perform live incident response, pull volatile RAM images, and run forensic scripts while keeping the host powered on.

Step-by-Step Solution

1
Analyze the incident requirements and constraints
Identified the need for immediate containment of C2 and lateral movement while preserving volatile memory (RAM).
Process hollowing resides in system memory; restarting or powering down host destroys volatile evidence.
2
Evaluate EDR containment capabilities against legacy controls
Determined that EDR host-level network isolation disables network adapters logically without interrupting agent-to-console management.
This maintains analyst access for RAM acquisition and response playbooks while cutting off the adversary completely.
3
Select the correct initial operational step
Host isolation via the EDR console is the best initial response action.
It satisfies containment objectives without violating the order of volatility in digital forensics.

Key Concept

EDR Endpoint Network Isolation and Forensic Volatility Preservation
Estimated Time:1m 30s
Question 2Question →

Security telemetry indicates that an administrative workstation has executed an unauthorized script attempting to establish a reverse shell to an external command-and-control (C2) server and extract system credentials. Which of the following response actions should an analyst perform directly using the Endpoint Detection and Response (EDR) agent to contain the threat while preserving forensic evidence? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply host network isolation through the EDR console to restrict network traffic exclusively to the security management channel.; Terminate the unauthorized process tree and quarantine the associated file artifacts using EDR response actions.

Answer

The correct containment and remediation actions are applying host network isolation through the EDR console and terminating the unauthorized process tree while quarantining file artifacts via EDR response tools.
Applying host network isolation via EDR blocks lateral network movement and external C2 communications while keeping the system running to preserve volatile RAM. Terminating the process tree and quarantining malicious files neutralizes execution directly at the endpoint level via native agent capabilities.

Step-by-Step Solution

1
Identify endpoint containment actions that prevent threat propagation without destroying system state.
Applying host network isolation blocks internal lateral movement and external C2 connections while preserving volatile RAM and maintaining agent connectivity.
Host isolation preserves volatile evidence while severing unauthorized network channels.
2
Apply process-level remediation directly on the endpoint using EDR execution management capabilities.
Killing the malicious process hierarchy and quarantining file artifacts halts further threat activity.
Direct EDR process termination neutralizes active attacks without resetting host hardware state.

Key Concept

Endpoint Detection and Response (EDR) Containment and Remediation Controls
Question 3Question →

A Security Operations Center (SOC) team is responding to a high-severity Endpoint Detection and Response (EDR) alert on a Linux server hosting critical API microservices. Telemetry indicates an adversary attempted to load an unsigned rootkit kernel module via the `init_module` system call while disabling the local `auditd` daemon. Which of the following initial containment and forensic actions should be executed to halt potential threat activity while preserving crucial digital evidence? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply software-level host isolation via the EDR agent interface to cut endpoint communication while preserving the agent management tunnel.; Trigger an automated volatile memory capture (RAM dump) on the system before terminating suspicious processes or restarting host services.

Answer

The correct response actions are applying software-level host isolation through the EDR management plane and initiating a volatile memory capture before executing process termination or host resets.
The correct measures involve isolating the host using the EDR agent's software control features and capturing volatile memory (RAM) before taking invasive recovery actions. Host isolation via EDR restricts network access to stop lateral movement while preserving the out-of-band agent communication link required for investigation. Capturing RAM preserves volatile kernel-mode artifacts and active memory structures necessary for rootkit forensic analysis.

Step-by-Step Solution

1
Evaluate the immediate threat posed by kernel-level tampering and potential lateral movement.
Identify that network isolation is required immediately to restrict adversary activity.
Kernel module manipulation indicates root-level access; network isolation prevents lateral propagation across adjacent API microservices.
2
Select the appropriate isolation mechanism that maintains security analyst management capabilities.
EDR agent host isolation severing non-management traffic.
Agent-based isolation blocks unauthorized network traffic while retaining the telemetry and remote shell capabilities of the EDR tool.
3
Prioritize digital evidence preservation according to the order of volatility.
Perform a volatile memory capture prior to host reboot or process termination.
Kernel modules and memory-resident rootkits reside in volatile system RAM and must be captured before rebooting or clearing process states.

Key Concept

EDR Host Containment & Volatile Evidence Preservation Workflow
Question 4Question →

During an active threat triage, telemetry from a critical workstation's Endpoint Detection and Response (EDR) agent alerts to suspicious memory modifications. An unprivileged process performed memory injection into a legitimate system binary using direct Native API system calls, bypassing user-mode API hooks. The rogue process has created an unbacked memory region executing stealthy code, but no outbound command-and-control (C2) network sockets have been established yet. Which action should the security analyst take FIRST via the EDR platform to mitigate risk without destroying essential volatile forensic evidence?

Show answer & explanation

Answer: Enable network-level host isolation through the EDR console while keeping the agent communication tunnel active.

Answer

Enable network-level host isolation through the EDR console while keeping the agent communication tunnel active.
Enabling network-level host isolation via the EDR agent isolates the host from all network communication (except the secure EDR management channel). This prevents any impending C2 connections or internal lateral movement while maintaining system power and process states so security analysts can capture volatile RAM evidence.

Step-by-Step Solution

1
Analyze threat context
Identified an active fileless in-memory process injection attack bypassing API hooks.
Understanding that the payload resides strictly in volatile memory dictates that host shutdown or process termination will destroy key forensic artifacts.
2
Evaluate containment options against forensic preservation requirements
Selecting EDR host isolation isolates the network adapter driver without killing processes or restarting the machine.
Host isolation breaks potential network paths to prevent lateral movement or C2 calls while keeping the host active for volatile RAM acquisition.
3
Execute immediate response action
Containment is applied instantly via the EDR control plane.
Agent-side network driver isolation takes effect instantly across all network interfaces, including internal LAN subnets.

Key Concept

EDR Host Isolation and Volatile Evidence Preservation
Question 5Question →

A tier 2 incident responder analyzing endpoint telemetry observes an active fileless attack on an enterprise financial server, where an injected process is issuing unauthorized API calls to extract credentials and establish an outbound encrypted beacon. To effectively contain the active compromise and preserve critical evidence for incident triage without losing agent telemetry, which of the following response actions should the responder perform using EDR agent capabilities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply host-level network isolation via the agent while maintaining the agent-to-console management connection; Capture a live volatile memory (RAM) dump of the endpoint directly through agent execution capabilities prior to terminating the suspicious process tree

Answer

The incident responder should apply host-level network isolation via the EDR agent while maintaining console connectivity, and capture a live volatile memory (RAM) dump of the host before terminating the suspicious process tree.
Combining host-level agent isolation with pre-remediation volatile memory acquisition enables incident responders to contain active network activity instantly while preserving volatile evidence necessary for root cause analysis.

Step-by-Step Solution

1
Isolate the compromised host at the endpoint layer via EDR console network containment features.
Network communication to external adversary infrastructure and adjacent internal network hosts is severed, stopping lateral movement while preserving SOC remote agent control.
Immediate containment at the host level prevents adversary expansion without blinding the security team.
2
Trigger volatile memory acquisition using EDR forensic capabilities prior to process kill execution.
In-memory code, injected DLLs, and volatile runtime evidence are preserved on disk or uploaded securely for forensic analysis.
Fileless memory threats disappear as soon as the host reboots or the process tree is killed.

Key Concept

EDR Host Isolation and Volatile Telemetry Preservation
Question 6Question →

A Security Operations Center (SOC) analyst receives a high-severity Endpoint Detection and Response (EDR) alert indicating an active living-off-the-land attack where a compromised workstation is attempting lateral movement via WMI and fileless memory injection. Arrange the following incident response containment and forensic actions in the correct sequential order from first step to last step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence places host network isolation first, followed by volatile memory collection, active process tree termination, and finally fleet-wide IOC ban rule enforcement.
In security incident response workflows, immediate containment of lateral movement is prioritized first by applying EDR network host isolation. Next, adherence to the order of volatility dictates collecting RAM and process dumps prior to killing active processes. Once volatile evidence is safely captured, active malicious process trees are terminated to stop local adversary activity. Finally, extracted IOCs are distributed enterprise-wide as EDR ban rules to protect remaining fleet endpoints.

Step-by-Step Solution

1
Isolate host using EDR network containment tools.
Network traffic to and from the host is restricted to the EDR cloud sensor, immediately stopping lateral movement.
Containment is the immediate priority during active lateral movement attacks to limit blast radius.
2
Trigger remote volatile RAM and process dump collection.
Volatile memory evidence is stored safely before process alteration.
Order of volatility requires capturing RAM and volatile evidence before altering system memory state.
3
Kill malicious processes and injected execution threads.
Malicious code execution on the endpoint ceases completely.
Terminating processes stops ongoing attacker activity without losing evidence previously captured in Step 2.
4
Distribute IOC ban rules across all enterprise EDR endpoints.
Enterprise-wide protection is established against the identified attack signature.
Remediation and preventive policy enforcement ensure fleet-wide protection after containment.

Key Concept

EDR Incident Containment Sequence & Volatility Management
Question 7Question →

An enterprise Security Operations Center (SOC) team is configuring an automated playbook within their Endpoint Detection and Response (EDR) solution to respond to an active ransomware outbreak involving credential dumping and process injection. Place the incident response steps in the correct operational order from initial containment through complete host restoration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper operational sequence begins with network isolation via the EDR agent, followed by volatile memory collection, process tree termination and token revocation, enterprise-wide IOC block rule propagation, and finally system integrity remediation prior to network restoration.
The correct sequence prioritizes halting threat spread first through EDR agent network isolation, preserving perishable volatile memory next before process termination, killing active malicious code execution third, deploying global block rules to protect other network assets fourth, and finally cleaning host artifacts before restoring network connectivity.

Step-by-Step Solution

1
Isolate the endpoint network connection via EDR software filters.
Halts lateral spread and data exfiltration instantly while keeping EDR communication open.
Immediate containment is mandatory prior to evidence collection or termination.
2
Acquire volatile memory image (RAM capture).
Preserves volatile injected DLLs, unwritten encryption keys, and active process handles.
Terminating malicious processes prior to memory capture permanently destroys critical forensic artifacts.
3
Kill malicious process tree and revoke associated session credentials.
Stops threat execution on the endpoint.
Active threat execution must be halted once volatile forensic data is secured.
4
Propagate newly identified file hashes and network indicators to the global EDR tenant block list.
Protects all uncompromised endpoints across the organization.
Global containment prevents lateral reinfection across non-isolated endpoints.
5
Remediate modified system binaries, verify baseline integrity, and remove host network isolation.
Returns the endpoint safely to normal operational status.
Host un-isolation should only occur after complete cleanup and integrity verification.

Key Concept

EDR Incident Response Playbook Sequencing
Question 8Question →

An enterprise Endpoint Detection and Response (EDR) system alerts a security analyst to an active malicious code injection on a user workstation. Sequence the standard EDR response steps from initial detection to host restoration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with initial behavioral detection and alerting, followed by immediate endpoint network isolation, process termination and forensic telemetry collection, and concludes with host restoration.
The proper incident response workflow following an EDR alert begins with detection, moves immediately to containment (host network isolation), proceeds to eradication and evidence capture (terminating processes and dumping memory), and finishes with recovery (restoring endpoint network access).

Step-by-Step Solution

1
Identify initial threat detection
The EDR agent flags anomalous activity and alerts analysts.
Incident response workflows begin with detection and triage.
2
Contain the threat
Network isolation is applied to the workstation via EDR.
Immediate containment prevents lateral spread while maintaining management connectivity.
3
Eradicate and analyze
Malicious processes are killed and process/memory telemetry is gathered.
Stopping threat activity and capturing volatile evidence enables root cause analysis without losing host context.
4
Restore host operations
The endpoint is verified secure and un-isolated.
Host network access is restored only after containment, investigation, and cleanup are complete.

Key Concept

EDR Incident Containment and Response Sequence
Question 9Question →

A Security Operations Center (SOC) analyst receives an alert showing that a user workstation is executing a suspicious PowerShell script attempting lateral movement across the network. Which of the following capabilities provided by an Endpoint Detection and Response (EDR) solution should the analyst execute immediately to contain the threat while preserving management access?

Show answer & explanation

Answer: Isolate the host from the network using the EDR console

Answer

Isolate the host from the network using the EDR console
The correct action is to isolate the host from the network using the EDR console. EDR host network isolation instantly restricts network communication to and from the infected endpoint, cutting off lateral propagation paths while maintaining administrative connection to the EDR agent for forensic collection and containment.

Step-by-Step Solution

1
Identify the primary operational requirement in an active containment scenario
The goal is to immediately halt lateral movement across the internal network.
Preventing the compromise of additional host systems is the top priority during incident response.
2
Evaluate EDR endpoint control features against traditional perimeter or antivirus controls
EDR host isolation disconnects host-to-host and host-to-internet network traffic while keeping agent telemetry operational.
Isolation stops internal attack propagation without shutting down the endpoint or severing management connectivity.

Key Concept

Endpoint Containment and Host Isolation in EDR
Estimated Time:45s
Question 10Question →

A security analyst receives an alert regarding an obfuscated command executing on a workstation assigned to an executive assistant. Traditional signature-based antivirus software on the host reported no malicious findings because the command payload was executed directly in memory without writing a file to the disk. However, the Endpoint Detection and Response (EDR) agent flagged the activity and blocked execution based on the anomalous process relationship where a word processing application spawned an encoded shell interpreter. Which EDR capability enabled the detection and intervention in this scenario?

Show answer & explanation

Answer: Behavioral anomaly detection and process lineage tracking

Answer

Behavioral anomaly detection and process lineage tracking enabled the EDR agent to detect and prevent the fileless memory execution.
The correct answer highlights behavioral anomaly detection and process lineage tracking. EDR solutions continuously record endpoint telemetry, including process trees, memory allocations, and command-line arguments. This allows EDR to identify suspicious behavior—such as a word processor spawning a command-line interpreter—even when no known malicious file signature exists.

Step-by-Step Solution

1
Analyze the attack vector and host indicators described in the scenario.
Identified that the attack uses fileless/in-memory execution by spawning a shell interpreter from a office document application without writing malicious files to disk.
Understanding the attack mechanism clarifies why signature-based controls fail.
2
Compare traditional antivirus capabilities with EDR functionalities.
Legacy antivirus relies on static file signatures and hashes, whereas EDR records host telemetry, tracks parent-child process lineage, and analyzes execution behaviors in real time.
Differentiating control mechanisms points to behavioral detection as the key capability.
3
Match the observed EDR intervention to the correct security feature.
The EDR agent detected the anomalous process lineage (word processor launching an encoded shell) and intervened dynamically.
Process lineage monitoring and behavioral heuristics directly address fileless and zero-day execution techniques.

Key Concept

EDR Behavioral Detection and Process Telemetry
Estimated Time:1m 15s
Question 11Question →

A security analyst monitoring a SOC console receives a high-severity alert from an Endpoint Detection and Response (EDR) agent on an enterprise workstation. The alert details rapid unauthorized file encryption and concurrent attempts at internal lateral movement. Which of the following containment actions should the analyst execute FIRST directly within the EDR console to minimize risk to the enterprise?

Show answer & explanation

Answer: Isolate the affected workstation from the network using the EDR agent isolation capability.

Answer

Isolate the affected workstation from the network using the EDR agent isolation capability.
Isolating the host via the EDR console instantly restricts network traffic from the host, preventing the spread of ransomware and lateral movement while maintaining an operational connection between the SOC analyst and the EDR agent for telemetry analysis.

Step-by-Step Solution

1
Analyze the incident response phase requirement.
Determine that the incident is actively progressing (rapid file encryption and lateral movement) and requires immediate containment.
Containment must occur before investigation or eradication to prevent widespread enterprise impact.
2
Select the appropriate EDR feature for host containment.
Execute network isolation via the EDR console interface.
EDR isolation severs host network communications (preventing lateral movement) while maintaining a managed telemetry link for security analysts.

Key Concept

Host Network Isolation in Endpoint Detection and Response
Question 12Question →

A security team is defining an automated containment and investigation workflow for suspicious host behavior flagged by an Endpoint Detection and Response (EDR) agent. Order the steps in the correct chronological sequence from initial detection through remediation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of the EDR incident response workflow is: (1) EDR sensor detects anomalous process behavior, (2) Automated playbook executes host isolation, (3) SOC analyst examines telemetry logs and process tree, (4) Forensic artifacts and memory dumps are collected, and (5) Newly identified IoCs are deployed to security controls.
The workflow follows standard incident response phases tailored to EDR functionality: Detection (EDR agent alerts on process anomaly) -> Containment (automated network isolation) -> Analysis (SOC analyst investigates process lineage) -> Investigation/Forensics (memory dump and artifact extraction) -> Remediation/Post-Incident (distributing IoCs enterprise-wide).

Step-by-Step Solution

1
Identify the event triggering the incident response sequence.
The EDR sensor identifies suspicious activity on the local endpoint.
Detection is the prerequisite step that triggers automated playbooks and alerts.
2
Contain the threat automatically using EDR capabilities.
Network interface of the affected host is isolated from the rest of the enterprise network.
Immediate containment limits blast radius and prevents lateral movement while preserving management access for EDR control.
3
Perform preliminary investigation of endpoint telemetry.
Analyst inspects process lineage, command-line arguments, and parent-child relationships.
Investigating telemetry confirms whether the alert is a true positive and pinpoints attacker tactics.
4
Collect deep forensic evidence.
Volatile memory and system triage packages are acquired from the isolated endpoint.
Detailed forensic collection supplies evidence for root-cause analysis and malware analysis.
5
Remediate and update organizational security posture.
Extracted IoCs are added to SIEM, firewalls, and EDR detection rules.
Feedback into security infrastructure prevents duplicate compromise across other enterprise endpoints.

Key Concept

Endpoint Detection and Response (EDR) Automated Containment and Incident Investigation Workflow
Question 13Question →

During an investigation into a ransomware propagation attempt on a critical enterprise server, a security analyst reviews telemetry captured by an Endpoint Detection and Response (EDR) agent. The EDR telemetry log reveals that an authenticated enterprise database daemon spawned a command-line interpreter, which subsequently executed `vssadmin.exe delete shadows /all /quiet`. The EDR agent's automated response policy immediately terminated the command interpreter and its child sub-processes and placed the endpoint into network isolation, but deliberately allowed the primary database daemon process to continue executing. Which of the following best explains the architectural rationale behind the EDR agent targeting only the child process tree during remediation?

Show answer & explanation

Answer: The EDR agent relies on process lineage and parent-child telemetry correlation to surgically terminate malicious execution contexts while maintaining essential host service uptime.

Answer

The EDR agent relies on process lineage and parent-child telemetry correlation to surgically terminate malicious execution contexts while maintaining essential host service uptime.
The correct answer emphasizes how EDR agents continuously record process creation lineage, maintaining parent-child process relationships. By correlating telemetry across process trees, the EDR agent's behavioral engine can surgically kill malicious child processes (such as a command shell attempting shadow copy deletion) while keeping critical parent enterprise applications running to prevent unnecessary downtime.

Step-by-Step Solution

1
Analyze the EDR telemetry context and process hierarchy described in the scenario.
The parent process (database daemon) is a legitimate enterprise service, while the child process (command interpreter invoking vssadmin.exe) represents malicious activity.
Identifying process tree relationships is critical to understanding how EDR sensors differentiate between normal application behavior and spawned malicious commands.
2
Evaluate EDR remediation capabilities and automated playbook logic.
EDR sensors track parent-child process IDs (PPID/PID) to kill specific process sub-trees selectively.
Surgical termination prevents full endpoint service disruption while still neutralizing malicious execution threads.
3
Differentiate EDR host-based capabilities from wrong control assumptions (privilege limits, network isolation scope, boundary controls).
EDR sensors operate with elevated privileges and perform host-level process termination independent of network boundary firewalls or data recovery routines.
Kernel-level endpoint monitoring guarantees process control, making targeted termination a deliberate design choice for system availability.

Key Concept

EDR Process Lineage Analysis and Targeted Remediation
Question 14Question →

An analyst is defining an automated incident response playbook within an Endpoint Detection and Response (EDR) system to handle high-severity malware execution alerts on enterprise workstations. Place the following steps of the automated containment, analysis, and recovery workflow in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the EDR response workflow begins with isolating the endpoint from the network, followed by terminating the malicious processes, gathering volatile memory telemetry for forensic analysis, and finally lifting network isolation after remediation.
The correct response order follows standard incident handling best practices in EDR environments: immediate network containment to prevent lateral movement, termination of malicious processes to stop active damage, acquisition of telemetry and forensics to analyze attack vectors, and host network restoration after remediation is confirmed.

Step-by-Step Solution

1
Perform immediate host isolation via EDR capabilities.
The endpoint is blocked from communicating with local network resources and external command-and-control servers while retaining EDR management connectivity.
Containment is the primary initial operational priority to restrict the attack blast radius without disrupting SOC control.
2
Terminate active threat processes.
Malicious process trees and memory-injected code execution are halted on the local host.
Stopping active malicious code prevents ongoing unauthorized actions, such as ransomware encryption or local credential harvesting.
3
Gather forensic telemetry and volatile memory artifacts.
Detailed process lineages, network sockets, and memory dumps are collected for SOC investigation.
Investigating telemetry determines the attack vector and identifies persistence mechanisms established prior to host isolation.
4
Lift host isolation and restore connectivity.
The host resumes standard enterprise network communications.
Network access should only be restored after confirming the host is completely remediated and secure.

Key Concept

EDR Automated Containment and Remediation Workflow
Question 15Question →

Place the following steps of an Endpoint Detection and Response (EDR) automated containment and incident investigation workflow in the correct sequential order from initial event detection to host restoration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows the standard incident containment lifecycle: telemetry detection of suspicious activity, automated network isolation, analyst investigation of process lineage telemetry, and final threat remediation followed by network restoration.
The workflow begins with continuous behavioral detection by the EDR agent. Once an alert triggers, automated playbooks isolate the endpoint from the network to block lateral spread while keeping memory intact. Next, a SOC analyst reviews the rich process lineage and telemetry gathered by the sensor to determine root cause. Finally, remediation scripts eradicate the threat and host network connectivity is safely restored.

Step-by-Step Solution

1
Identify initial threat detection
The local EDR sensor flags anomalous behavior via host telemetry monitoring.
Detection must occur before any containment or investigation actions can be initiated.
2
Execute immediate automated containment
Network isolation is automatically applied to the affected endpoint.
Isolating the endpoint stops lateral movement across the enterprise network while preserving host volatility.
3
Conduct analyst telemetry investigation
The analyst examines process trees and parent-child execution paths in the central EDR console.
Investigation must take place on the isolated endpoint's collected data to understand the attack scope.
4
Perform threat remediation and host restoration
Malicious items are cleaned and full network connectivity is reinstated.
Remediation and reconnecting the system to normal operations is the final step in resolving an endpoint incident.

Key Concept

EDR Incident Containment and Response Lifecycle
Estimated Time:1m 0s
Question 16Question →

A security administrator notices that a host security tool generated an alert for an obfuscated script running directly out of system memory using a built-in operating system utility, despite no known file hashes being flagged. Which of the following capabilities best explains why an Endpoint Detection and Response (EDR) agent can identify this suspicious activity?

Show answer & explanation

Answer: Continuous host process monitoring and behavioral telemetry analysis

Answer

Continuous host process monitoring and behavioral telemetry analysis allows EDR solutions to detect suspicious, fileless, or memory-based actions even when traditional static signature matching yields no results.
Endpoint Detection and Response (EDR) solutions monitor endpoint activities in real time, gathering telemetry on process execution, system calls, and memory usage. This allows them to spot behavioral anomalies—such as an administrative tool executing obfuscated scripts—regardless of whether a file signature exists.

Step-by-Step Solution

1
Analyze the scenario conditions
The attack involves an obfuscated script executed in memory via built-in system tools with no matching file signatures.
Identifying that no malicious file exists on disk rules out static signature-based detection mechanisms.
2
Evaluate EDR core capabilities
EDR agents continuously collect detailed process interaction, registry, and memory telemetry from the endpoint.
Behavioral analytics inspect runtime actions rather than static file attributes.
3
Select the matching security capability
Continuous host process monitoring and behavioral telemetry analysis is the primary mechanism for detecting living-off-the-land and fileless attacks.
This capability addresses host-level runtime anomalies.

Key Concept

Endpoint Detection and Response (EDR) behavioral monitoring
Estimated Time:45s
Question 17Question →

An organization is deploying an Endpoint Detection and Response (EDR) agent across all enterprise hosts. Which of the following core capabilities differentiate EDR solutions from traditional signature-based antivirus software? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Continuous real-time collection and analysis of endpoint behavioral telemetry; Remote network isolation of compromised hosts while preserving management access

Answer

The features that distinguish EDR solutions from legacy antivirus are continuous real-time collection of endpoint behavioral telemetry and remote network isolation of compromised hosts.
Endpoint Detection and Response (EDR) solutions extend beyond traditional antivirus by continuously recording host behavioral telemetry (such as process trees, file modifications, and local network connections) and enabling rapid containment actions like network isolation of compromised endpoints.

Step-by-Step Solution

1
Identify key EDR features.
EDR emphasizes continuous host telemetry collection and active containment options such as network isolation.
Legacy antivirus relies primarily on static file signatures, whereas EDR continuously analyzes behavior and provides direct incident response capabilities.
2
Evaluate wrong options.
IP reputation filtering is a network firewall control, and assuming internal host trustworthiness relies on perimeter trust rather than endpoint monitoring.
These distractor options represent perimeter control functions or flawed security assumptions rather than host EDR features.

Key Concept

Endpoint Detection and Response (EDR) Core Functions
Estimated Time:1m 0s
Question 18Question →

A security analyst is investigating a stealthy compromise on an enterprise server where an attacker executed an obfuscated script directly in host memory using native tools, avoiding writing any malicious files to the disk. Standard signature-based antivirus software and perimeter firewalls failed to detect the activity. Which capability of Endpoint Detection and Response (EDR) provides the visibility required to identify and trace this fileless execution?

Show answer & explanation

Answer: Continuous behavioral monitoring and process parent-child lineage tracking

Answer

Continuous behavioral monitoring and process parent-child lineage tracking
The correct answer highlights EDR's ability to monitor ongoing endpoint behavior and process trees in real time. Because fileless attacks execute directly in volatile memory using native system binaries (Living off the Land), traditional static file checks fail. EDR solves this by recording runtime telemetry, including parent-child process chains and command-line parameters.

Step-by-Step Solution

1
Analyze the attack vector described in the scenario
The attack uses fileless execution techniques, relying on memory-resident script execution via native binaries without dropping files to disk.
Understanding that no file was created eliminates static inspection methods that depend on file system artifacts.
2
Evaluate the capabilities of security monitoring technologies against fileless execution
EDR agents maintain continuous telemetry on process creation, memory activity, and execution arguments on host endpoints.
Process lineage tracking enables visibility into abnormal execution flows, such as a legitimate system utility spawning an unexpected command shell.
3
Select the option that specifically addresses host process and memory execution tracking
Continuous behavioral monitoring and process lineage tracking is the core EDR function designed for fileless threat detection.
It captures real-time endpoint behavioral anomalies regardless of file signature presence.

Key Concept

EDR Behavioral Telemetry & Fileless Threat Detection
Question 19Question →

An organization is deploying an Endpoint Detection and Response (EDR) agent across its fleet of enterprise workstations to enhance host-level threat detection and incident containment capabilities. Which of the following represent core operational features provided by an EDR solution? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Continuous host telemetry collection and behavioral monitoring of active processes, registry changes, and memory executions; Automated host network isolation to stop lateral movement upon high-confidence threat detection

Answer

The correct answers are the continuous host telemetry collection and behavioral monitoring of active processes, registry changes, and memory executions, along with automated host network isolation to stop lateral movement upon high-confidence threat detection.
Endpoint Detection and Response (EDR) agents provide continuous visibility into host activity by recording behavioral telemetry (process creation, file writes, network sockets, memory allocation) and support active response mechanisms like automated endpoint isolation to mitigate malicious lateral movement.

Step-by-Step Solution

1
Identify the primary scope of Endpoint Detection and Response (EDR) technology.
EDR focuses specifically on host-level security observability, behavioral telemetry, continuous recording of system events, and proactive containment.
Understanding the boundary between endpoint monitoring and network/perimeter controls helps isolate valid EDR features.
2
Evaluate options offering continuous monitoring and automated containment.
Real-time process telemetry logging and automated network isolation of compromised host devices are standard EDR functions.
EDR replaces legacy signature-only scanning with continuous monitoring and automated playbooks for incident containment.
3
Differentiate EDR from network perimeter controls and legacy signature-based antivirus.
Edge traffic inspection belongs to network firewalls/IPS, while signature-based batch disk scanning characterizes legacy antivirus.
EDR operates on the endpoint itself using behavioral monitoring rather than relying on perimeter filtering or static signatures.

Key Concept

Core capabilities of Endpoint Detection and Response (EDR)
Question 20Question →

A technician identifies an active malware infection on an enterprise desktop. To stop lateral movement without losing volatile memory evidence, the technician uses the Endpoint Detection and Response (EDR) console. Which of the following capabilities should the technician execute?

Show answer & explanation

Answer: Perform host network isolation via the EDR agent

Answer

Perform host network isolation via the EDR agent
Performing host network isolation directly through the EDR agent prevents the endpoint from communicating with any local or remote network resources, halting lateral malware propagation while maintaining machine power so security responders can harvest volatile RAM memory.

Step-by-Step Solution

1
Identify the primary operational constraint and goal
The goal is to halt lateral threat movement immediately while preserving volatile system memory (RAM).
Shutting down the host loses volatile evidence, while network-based filtering does not block internal local communication effectively.
2
Evaluate EDR endpoint control capabilities
Host network isolation cuts off all host network interface adapters remotely via the installed EDR agent while keeping system state active.
This isolates the compromised host from the enterprise network without powering down the device.

Key Concept

EDR Host Isolation and Volatile Evidence Preservation
Page 1 / 4Next
Endpoint Detection and Response (EDR) Practice Questions — CompTIA Security+ | Examkin