Examkin

Soru

Zorluk: ZorEndpoint Detection and Response (EDR)

A Security Operations Center (SOC) analyst is reviewing an automated response playbook triggered by an Endpoint Detection and Response (EDR) agent following a suspected credential dumping attack against a high-value server. In what chronological sequence should the EDR agent and SOC workflow execute these actions to contain the threat and preserve forensic evidence?

  1. 1Detect anomalous API memory read requests targeting the Local Security Authority Subsystem Service (LSASS) process.
  2. 2Enforce host-level software network isolation to prevent lateral movement while preserving agent management telemetry.
  3. 3Capture a volatile RAM memory dump and terminate the offending injector process tree.
  4. 4Query tenant-wide EDR telemetry using process hashes and parent-child execution lineages to identify other impacted endpoints.

Cevap

The correct chronological sequence is: 1) Detect anomalous API memory read requests targeting LSASS, 2) Enforce host-level software network isolation, 3) Capture a volatile memory dump and terminate the offending process tree, and 4) Query tenant-wide EDR telemetry to identify other impacted endpoints.
The sequence follows the core EDR lifecycle: Detection must precede response; host-level network isolation must be established immediately after detection to block lateral spread; volatile memory collection and process termination follow isolation to safely remediate the host; and tenant-wide telemetry correlation occurs last to assess broader enterprise compromise.

Adım Adım Çözüm

1
Identify initial threat activity.
The EDR behavioral monitor alerts on unauthorized memory access to sensitive system processes.
Detection provides the trigger for automated playbook execution.
2
Isolate the compromised system.
Host-based firewall rules block all inbound/outbound communication except EDR management connections.
Containment limits adversary lateral movement while keeping SOC visibility intact.
3
Acquire evidence and eradicate host execution.
Physical memory artifacts are saved to disk, followed by process tree termination.
Preserving volatile RAM prior to or simultaneously with process termination ensures critical memory-resident indicators are retained.
4
Perform enterprise scope analysis.
Telemetry indicators from the alert are cross-referenced across all enterprise endpoints.
Broader threat hunting ensures full scope eradication across the enterprise domain.

Anahtar Kavram

EDR Automated Containment and Incident Response Workflow Sequence
Bu soruyu puanla

Konular

Endpoint Detection and Response (EDR)

Bu konudan daha fazla soru