Examkin

Soru

Zorluk: KolayEndpoint Detection and Response (EDR)

A technician identifies an active malware infection on an enterprise desktop. To stop lateral movement without losing volatile memory evidence, the technician uses the Endpoint Detection and Response (EDR) console. Which of the following capabilities should the technician execute?

  1. Perform host network isolation via the EDR agentCevap
  2. B
    Apply a perimeter firewall block rule for the infected host IP address
  3. C
    Remotely power off the machine to stop malicious process execution
  4. D
    Enable a detective packet logging filter on the local network switch

Cevap

Perform host network isolation via the EDR agent
Performing host network isolation directly through the EDR agent prevents the endpoint from communicating with any local or remote network resources, halting lateral malware propagation while maintaining machine power so security responders can harvest volatile RAM memory.

Adım Adım Çözüm

1
Identify the primary operational constraint and goal
The goal is to halt lateral threat movement immediately while preserving volatile system memory (RAM).
Shutting down the host loses volatile evidence, while network-based filtering does not block internal local communication effectively.
2
Evaluate EDR endpoint control capabilities
Host network isolation cuts off all host network interface adapters remotely via the installed EDR agent while keeping system state active.
This isolates the compromised host from the enterprise network without powering down the device.

Anahtar Kavram

EDR Host Isolation and Volatile Evidence Preservation
Bu soruyu puanla

Konular

Endpoint Detection and Response (EDR)

Bu konudan daha fazla soru