Examkin

Soru

Zorluk: KolayEndpoint Detection and Response (EDR)

A security analyst notices suspicious process execution on a financial department workstation during an active malware outbreak. To immediately block the workstation's network communication with other internal systems while preserving the security team's remote telemetry and control channel, which of the following is the most appropriate action to take?

  1. Perform a network host isolation action through the EDR consoleCevap
  2. B
    Modify ingress rules on the enterprise border firewall to block internal host traffic
  3. C
    Push an updated signature file to legacy antivirus software on the local subnet
  4. D
    Reassign the host system logging policy to a detective control classification

Cevap

Perform a network host isolation action through the EDR console
Executing a host isolation feature via an EDR platform severs all network traffic to and from the targeted workstation except for the encrypted connection between the EDR agent and its management console. This effectively stops lateral movement while enabling continuous incident investigation.

Adım Adım Çözüm

1
Identify the primary operational requirement during containment
The goal is to stop lateral movement across internal systems while keeping host telemetry and remote management functional.
Containment must block malicious network traffic without losing control over the compromised endpoint.
2
Evaluate Endpoint Detection and Response (EDR) host isolation capabilities
EDR agents can isolate the endpoint software-wise, restricting network adapters to communicate only with the EDR management console.
This prevents lateral spread while allowing analysts to inspect memory, terminate processes, and gather telemetry.

Anahtar Kavram

Endpoint Network Isolation
Bu soruyu puanla

Konular

Endpoint Detection and Response (EDR)

Bu konudan daha fazla soru