A Security Operations Center (SOC) analyst receives a high-severity alert indicating that a powershell process on an internal endpoint is performing process injection into system memory. The analyst needs to immediately contain the active threat and prevent potential lateral movement across the internal network while maintaining remote administrative management to investigate the endpoint. Which of the following actions performed via an Endpoint Detection and Response (EDR) agent best achieves this goal?
- Apply host network isolation to sever standard network communications while preserving agent telemetry and management connectivity.Cevap
- BCreate a temporary blocking rule on the internal perimeter firewall targeting the workstation's subnet.
- CInitiate a signature-based full disk scan to locate and quarantine the executable on the filesystem.
- DDeploy an emergency operating system patch to address the memory management vulnerability.
Cevap
Apply host network isolation via the EDR agent to cut standard host network access while preserving agent-to-console management connectivity.
Host network isolation executed by an EDR agent restricts all network traffic to and from the affected endpoint at the host network driver layer, preventing lateral movement across the network while keeping the EDR agent's communication channel open for remote investigation and response.
Adım Adım Çözüm
Anahtar Kavram
EDR Host Network Isolation