A tier 2 incident responder analyzing endpoint telemetry observes an active fileless attack on an enterprise financial server, where an injected process is issuing unauthorized API calls to extract credentials and establish an outbound encrypted beacon. To effectively contain the active compromise and preserve critical evidence for incident triage without losing agent telemetry, which of the following response actions should the responder perform using EDR agent capabilities? (Select TWO.)
- Apply host-level network isolation via the agent while maintaining the agent-to-console management connectionCevap
- Capture a live volatile memory (RAM) dump of the endpoint directly through agent execution capabilities prior to terminating the suspicious process treeCevap
- CReconfigure edge firewall rules to block the destination C2 IP address across the entire subnetwork
- DPush an updated static antivirus signature definition file to the host and initiate a full disk quarantine scan
Cevap
The incident responder should apply host-level network isolation via the EDR agent while maintaining console connectivity, and capture a live volatile memory (RAM) dump of the host before terminating the suspicious process tree.
Combining host-level agent isolation with pre-remediation volatile memory acquisition enables incident responders to contain active network activity instantly while preserving volatile evidence necessary for root cause analysis.
Adım Adım Çözüm
Anahtar Kavram
EDR Host Isolation and Volatile Telemetry Preservation