Examkin

Soru

Zorluk: ZorEndpoint Detection and Response (EDR)

An Endpoint Detection and Response (EDR) agent on a critical enterprise macOS host generates a high-priority alert indicating that an unprivileged process is attempting direct system calls to read sensitive memory structures, bypassing user-mode security hooks. Which of the following actions performed via the EDR administration console is the most appropriate immediate step to contain the incident while preserving volatile forensic evidence?

  1. Initiate network-level host isolation of the endpoint through the EDR console.Cevap
  2. B
    Send a remote hard shutdown command to the host to terminate malicious process execution.
  3. C
    Update perimeter firewall rules to block inbound and outbound traffic for the host's IP address.
  4. D
    Deploy an updated signature definition database to the endpoint legacy antivirus software.

Cevap

Initiate network-level host isolation of the endpoint through the EDR console.
Initiating network-level host isolation via the EDR console immediately disconnects the endpoint from external network communications and internal lateral movement vectors. Crucially, host isolation allows the OS to remain powered on so security analysts can remotely collect volatile memory (RAM) and EDR telemetry for forensic investigation.

Adım Adım Çözüm

1
Identify the primary threat containment objective.
Recognize that memory manipulation attacks require stopping active malicious propagation without destroying volatile system memory.
Shutting down the host loses critical RAM artifacts needed for memory analysis.
2
Evaluate EDR containment capabilities vs legacy or network controls.
EDR host isolation places software-level network filters directly on the host interface, disabling external communications while preserving local system state and analyst management sessions.
Perimeter firewalls do not prevent local segment lateral movement, and antivirus signatures cannot stop in-memory execution.
3
Select the correct EDR workflow response.
Host isolation provides immediate containment compliant with proper incident response phase sequence.
Containment must occur before full eradication and recovery, without violating evidence preservation principles.

Anahtar Kavram

EDR Host Isolation and Telemetry Preservation
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Endpoint Detection and Response (EDR)

Bu konudan daha fazla soru