CompTIA Security+ (SY0-701)Security OperationsHard
A security team is implementing new endpoint protection. They require a tool that provides continuous monitoring, real-time visibility into endpoint activities, threat hunting capabilities, and the ability to initiate remote response actions like isolating a compromised host. Which solution best meets these comprehensive requirements?
- ASecurity Information and Event Management (SIEM)
- BNext-Generation Antivirus (NGAV)
- CEndpoint Detection and Response (EDR)
- DData Loss Prevention (DLP)
Show answer & explanationAnswer & explanation
Correct answer: C. Endpoint Detection and Response (EDR)
Endpoint Detection and Response (EDR) solutions are specifically designed to provide continuous monitoring, real-time visibility into endpoint activities, advanced threat detection (including threat hunting), and robust response capabilities such as isolating compromised hosts. NGAV offers advanced detection but typically lacks the deep visibility and active response of EDR.
Why the other options are wrong
- A. SIEM aggregates and correlates logs from various sources across the infrastructure, but it is not an endpoint-specific solution for real-time visibility and direct response on endpoints.
- B. NGAV provides advanced detection but generally lacks the deep visibility for threat hunting and comprehensive remote response actions of EDR.
- D. DLP focuses on preventing sensitive data from leaving the organization, which is unrelated to endpoint monitoring, threat hunting, or host isolation.
Endpoint Detection and Response (EDR)
An integrated endpoint security solution that continuously monitors and records endpoint activity data, enabling real-time threat detection, investigation, and automated response capabilities.
- Provides deep visibility into endpoint events.
- Enables proactive threat hunting.
- Facilitates rapid incident response actions (e.g., host isolation).
Memory trick: EDR: 'Examine, Detect, Respond' on the endpoint.