Examkin

Soru

Zorluk: KolayEndpoint Detection and Response (EDR)

A security administrator notices that a host security tool generated an alert for an obfuscated script running directly out of system memory using a built-in operating system utility, despite no known file hashes being flagged. Which of the following capabilities best explains why an Endpoint Detection and Response (EDR) agent can identify this suspicious activity?

  1. Continuous host process monitoring and behavioral telemetry analysisCevap
  2. B
    Static signature comparisons against cloud database file hashes
  3. C
    In-line edge firewall filtering of incoming network packet payloads
  4. D
    Network-based intrusion prevention system rules matching known exploit signatures

Cevap

Continuous host process monitoring and behavioral telemetry analysis allows EDR solutions to detect suspicious, fileless, or memory-based actions even when traditional static signature matching yields no results.
Endpoint Detection and Response (EDR) solutions monitor endpoint activities in real time, gathering telemetry on process execution, system calls, and memory usage. This allows them to spot behavioral anomalies—such as an administrative tool executing obfuscated scripts—regardless of whether a file signature exists.

Adım Adım Çözüm

1
Analyze the scenario conditions
The attack involves an obfuscated script executed in memory via built-in system tools with no matching file signatures.
Identifying that no malicious file exists on disk rules out static signature-based detection mechanisms.
2
Evaluate EDR core capabilities
EDR agents continuously collect detailed process interaction, registry, and memory telemetry from the endpoint.
Behavioral analytics inspect runtime actions rather than static file attributes.
3
Select the matching security capability
Continuous host process monitoring and behavioral telemetry analysis is the primary mechanism for detecting living-off-the-land and fileless attacks.
This capability addresses host-level runtime anomalies.

Anahtar Kavram

Endpoint Detection and Response (EDR) behavioral monitoring
Tahmini Süre:45s
Bu soruyu puanla

Konular

Endpoint Detection and Response (EDR)

Bu konudan daha fazla soru