Examkin

Soru

Zorluk: KolayEndpoint Detection and Response (EDR)

A system administrator needs to deploy a security control to enterprise endpoints that continuously monitors local host activity, logs process execution lineage, and enables immediate network isolation of compromised devices. Which of the following security solutions best meets these requirements?

  1. Endpoint Detection and Response (EDR)Cevap
  2. B
    Stateful Packet Inspection Firewall
  3. C
    Signature-based Antivirus (AV)
  4. D
    Network Intrusion Detection System (NIDS)

Cevap

Endpoint Detection and Response (EDR)
Endpoint Detection and Response (EDR) solutions utilize host agents to gather real-time process execution metrics, analyze process trees for anomalous behavior, and provide immediate containment mechanisms such as host-level network isolation.

Adım Adım Çözüm

1
Analyze the operational requirements provided in the scenario.
Identified the need for host telemetry logging, process lineage tracking, and automated host isolation.
These controls require an agent running directly on the operating system capable of inspecting system behavior and altering network adapter connectivity.
2
Compare candidate security tools against the required capabilities.
Endpoint Detection and Response (EDR) provides real-time process monitoring, behavioral detection, and automated host isolation features.
EDR specifically expands beyond legacy static signature scanning to capture host execution contexts and enable active incident containment.

Anahtar Kavram

Endpoint Detection and Response (EDR) Core Capabilities
Tahmini Süre:45s
Bu soruyu puanla

Konular

Endpoint Detection and Response (EDR)

Bu konudan daha fazla soru