Examkin

Soru

Zorluk: OrtaEndpoint Detection and Response (EDR)

A security analyst receives an alert regarding an obfuscated command executing on a workstation assigned to an executive assistant. Traditional signature-based antivirus software on the host reported no malicious findings because the command payload was executed directly in memory without writing a file to the disk. However, the Endpoint Detection and Response (EDR) agent flagged the activity and blocked execution based on the anomalous process relationship where a word processing application spawned an encoded shell interpreter. Which EDR capability enabled the detection and intervention in this scenario?

  1. Behavioral anomaly detection and process lineage trackingCevap
  2. B
    Static signature matching against a centralized file hash repository
  3. C
    Inbound perimeter firewall packet inspection and domain filtering
  4. D
    Automated patch management and vulnerability scanning

Cevap

Behavioral anomaly detection and process lineage tracking enabled the EDR agent to detect and prevent the fileless memory execution.
The correct answer highlights behavioral anomaly detection and process lineage tracking. EDR solutions continuously record endpoint telemetry, including process trees, memory allocations, and command-line arguments. This allows EDR to identify suspicious behavior—such as a word processor spawning a command-line interpreter—even when no known malicious file signature exists.

Adım Adım Çözüm

1
Analyze the attack vector and host indicators described in the scenario.
Identified that the attack uses fileless/in-memory execution by spawning a shell interpreter from a office document application without writing malicious files to disk.
Understanding the attack mechanism clarifies why signature-based controls fail.
2
Compare traditional antivirus capabilities with EDR functionalities.
Legacy antivirus relies on static file signatures and hashes, whereas EDR records host telemetry, tracks parent-child process lineage, and analyzes execution behaviors in real time.
Differentiating control mechanisms points to behavioral detection as the key capability.
3
Match the observed EDR intervention to the correct security feature.
The EDR agent detected the anomalous process lineage (word processor launching an encoded shell) and intervened dynamically.
Process lineage monitoring and behavioral heuristics directly address fileless and zero-day execution techniques.

Anahtar Kavram

EDR Behavioral Detection and Process Telemetry
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Endpoint Detection and Response (EDR)

Bu konudan daha fazla soru