Examkin

Soru

Zorluk: OrtaEndpoint Detection and Response (EDR)

During a routine operational review of corporate laptops, endpoint telemetry detects a malicious script executing directly in volatile memory and initiating unauthorized outbound traffic to a known adversary infrastructure. To stop lateral movement and data exfiltration immediately while retaining live memory context for incident investigation, which of the following EDR capabilities should be executed?

  1. Initiating agent-based network host isolationCevap
  2. B
    Modifying internal perimeter firewall access control lists (ACLs)
  3. C
    Deploying an emergency static signature update to legacy antivirus software
  4. D
    Applying an operating system patch to mitigate the underlying execution vulnerability

Cevap

Initiating agent-based network host isolation is the correct capability because it disconnects the host from the internal network while keeping EDR communication open and preserving volatile memory.
Initiating agent-based network isolation enables security analysts to halt all unauthorized network communications to and from the endpoint instantly while preserving system state and volatile memory for forensic response.

Adım Adım Çözüm

1
Identify the immediate incident response priority
Containment is required to halt lateral movement and data exfiltration without losing RAM evidence.
Active fileless memory threats require host containment mechanisms rather than static perimeter blocking.
2
Evaluate EDR containment actions
Agent-based network isolation cuts off non-essential network connections at the host level while maintaining administrative console connectivity.
This allows SOC responders to investigate live memory while preventing the adversary from moving laterally.

Anahtar Kavram

Endpoint Detection and Response (EDR) Host Isolation
Bu soruyu puanla

Konular

Endpoint Detection and Response (EDR)

Bu konudan daha fazla soru