Examkin

Soru

Zorluk: OrtaEndpoint Detection and Response (EDR)

Following a phishing simulation report, a security analyst reviews telemetry to identify systems where an unauthorized script executed via a native administrative tool without creating new executable files on disk. Traditional signature-based antivirus on the endpoints flagged no alerts. Which of the following Endpoint Detection and Response (EDR) capabilities allows the analyst to identify this activity?

  1. Process lineage tracking and behavioral telemetry collectionCevap
  2. B
    Static file signature updates pushed from a central management console
  3. C
    Perimeter firewall packet inspection and network rule adjustments
  4. D
    Operating system mandatory access control enforcement

Cevap

Process lineage tracking and behavioral telemetry collection
Process lineage tracking and behavioral telemetry collection allow EDR solutions to monitor process creation events, command-line arguments, and parent-child execution hierarchies. This enables analysts to spot suspicious activity, such as legitimate system binaries executing unusual commands, even when no malware binary is written to the disk.

Adım Adım Çözüm

1
Analyze the incident context and attack vector.
Identified a fileless attack where native system binaries execute malicious scripts without saving new files to disk.
Traditional antivirus fails to detect this activity because no known malicious file signature is created on the filesystem.
2
Evaluate the required security capability to detect fileless activity.
Determined that monitoring runtime execution logic, parent-child process chains, and system behavior is necessary.
Fileless threats rely on legitimate binaries, requiring context-aware behavioral inspection rather than static file hash matching.
3
Select the EDR feature that provides this monitoring capability.
Process lineage tracking and behavioral telemetry collection.
EDR records the relationships between parent and child processes (such as a word processor launching a command shell), capturing anomalous behavior across endpoints.

Anahtar Kavram

Endpoint Detection and Response (EDR) behavioral telemetry and process lineage
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Endpoint Detection and Response (EDR)

Bu konudan daha fazla soru