Cisco CCNP Security Core (SCOR) 350-701Endpoint Security and Secure Network AccessMedium
A security analyst is investigating a suspected malware infection on an endpoint that bypassed traditional antivirus. The analyst needs to understand the full scope of the attack, including process spawns, file modifications, and network connections originating from the compromised host, to contain and remediate effectively. Which endpoint security technology is best suited for this detailed forensic analysis and threat hunting?
- AData Loss Prevention (DLP)
- BEndpoint Detection and Response (EDR)
- CSecurity Information and Event Management (SIEM)
- DNext-Generation Antivirus (NGAV)
Show answer & explanationAnswer & explanation
Correct answer: B. Endpoint Detection and Response (EDR)
Endpoint Detection and Response (EDR) systems continuously monitor and collect data from endpoints, providing the visibility needed for detailed forensic analysis, threat hunting, and understanding the full attack chain, which is crucial when traditional defenses are bypassed.
Why the other options are wrong
- A. DLP focuses on preventing sensitive data exfiltration, not comprehensive threat investigation.
- C. SIEM aggregates logs from various sources but doesn't provide the deep, granular endpoint telemetry that EDR does for forensic analysis.
- D. NGAV primarily focuses on preventing known and unknown malware execution, but EDR goes beyond prevention to detect and respond to advanced threats post-execution.
Endpoint Detection and Response (EDR)
A cybersecurity solution that continuously monitors and collects endpoint data, providing real-time visibility, threat detection, and response capabilities.
- Offers deep visibility into endpoint activities.
- Facilitates threat hunting and forensic investigations.
- Goes beyond traditional antivirus by focusing on post-compromise detection and response.
Memory trick: When the antivirus fails, EDR is the 'detective' for your endpoint.