Trending Technologies MCQs

Endpoint Detection and Response (EDR) MCQs (Multiple-Choice Questions)

Test your knowledge of Endpoint Detection and Response (EDR) with these multiple-choice questions. This collection covers EDR architecture, endpoint telemetry, threat detection, behavioral analysis, incident investigation, threat hunting, malware detection, and automated response techniques used to protect computers and servers from cybersecurity threats.

Endpoint Detection and Response (EDR) MCQs

Endpoint Detection and Response is a cybersecurity approach that continuously monitors endpoint devices, such as laptops, desktops, and servers, to identify suspicious activities and investigate potential security incidents. EDR solutions collect endpoint events, analyze process behavior, detect threats, and provide security teams with tools to investigate and respond to attacks.

These EDR MCQs cover both foundational concepts and practical security operations. They explore endpoint agents, telemetry collection, behavioral detection, attack investigation, containment, forensic evidence, threat intelligence, and the differences between EDR and other security technologies.

List of Endpoint Detection and Response (EDR) MCQs

The following questions progress from basic EDR concepts to advanced detection and incident response scenarios. They are useful for cybersecurity students, security analysts, SOC professionals, certification preparation, and anyone learning endpoint security operations.

1. What is the primary purpose of Endpoint Detection and Response (EDR)?

To manage employee attendance
To monitor endpoints, detect suspicious activities, and support incident response
To replace all network routing devices
To provide only file compression services

Answer: B) To monitor endpoints, detect suspicious activities, and support incident response

Explanation:

EDR continuously collects endpoint activity data, identifies potential threats, supports investigations, and enables actions such as isolating compromised devices or terminating malicious processes.

2. Which device is an example of an endpoint monitored by an EDR solution?

A laptop used by an employee
A printed paper document
A passive network cable
A mechanical door lock without connected computing components

Answer: A) A laptop used by an employee

Explanation:

Endpoints are computing devices that connect to an organization's systems or networks. Laptops, desktops, servers, and supported virtual machines are common EDR-managed endpoints.

3. What is the main role of an EDR agent?

To manufacture endpoint hardware
To assign physical office seating
To collect endpoint telemetry and support security monitoring
To remove the need for operating system updates

Answer: C) To collect endpoint telemetry and support security monitoring

Explanation:

An EDR agent runs on a supported endpoint and collects information such as process execution, file activity, network connections, and relevant system events. Depending on the product, it can also enforce security actions.

4. Which type of information is commonly collected by EDR software?

Employee lunch preferences only
Office furniture inventory only
Printed document dimensions only
Process execution, file modifications, and network connection events

Answer: D) Process execution, file modifications, and network connection events

Explanation:

EDR relies on endpoint telemetry to establish what happened on a device. Process creation, command-line arguments, file changes, user activity, and network connections can help reveal malicious behavior.

5. How does EDR differ from traditional antivirus software?

EDR focuses on detection, investigation, and response using endpoint activity data, while traditional antivirus often emphasizes malware prevention and removal
EDR works only on printers
Traditional antivirus always provides more forensic detail than EDR
EDR cannot identify suspicious processes

Answer: A) EDR focuses on detection, investigation, and response using endpoint activity data, while traditional antivirus often emphasizes malware prevention and removal

Explanation:

Traditional antivirus commonly detects known malware using signatures and other detection methods. EDR adds continuous visibility, behavioral analysis, investigation timelines, threat hunting, and response capabilities. Modern antivirus and EDR features may overlap.

6. What is endpoint telemetry in EDR?

A physical sensor used only for measuring room temperature
Data describing activities and events occurring on an endpoint
A method for increasing screen resolution
A backup copy of a keyboard layout

Answer: B) Data describing activities and events occurring on an endpoint

Explanation:

Endpoint telemetry consists of security-relevant observations collected from a device. It helps analysts reconstruct activity, correlate events, recognize attack patterns, and determine whether a system has been compromised.

7. Which detection approach identifies threats by examining suspicious behavior rather than relying only on known malware signatures?

Disk partitioning
Static IP address assignment
Behavioral analysis
File compression

Answer: C) Behavioral analysis

Explanation:

Behavioral analysis examines actions such as unusual process creation, suspicious script execution, credential access, or mass file encryption. It can help detect previously unseen threats, although legitimate software can sometimes exhibit similar behavior.

8. What does endpoint isolation do during a security incident?

Physically destroys the affected device
Deletes every file on the endpoint automatically
Disables all security monitoring permanently
Restricts the endpoint's network communications to help contain the threat

Answer: D) Restricts the endpoint's network communications to help contain the threat

Explanation:

Endpoint isolation limits a compromised device's ability to communicate with other systems or external destinations. Depending on the EDR product, management and response communications may remain available so analysts can investigate and remediate the device.

9. Which activity is an example of threat hunting with EDR?

Searching endpoint telemetry for suspicious PowerShell execution across multiple devices
Changing the color of employee desktop backgrounds
Scheduling routine office cleaning
Measuring printer paper consumption

Answer: A) Searching endpoint telemetry for suspicious PowerShell execution across multiple devices

Explanation:

Threat hunting is the proactive investigation of systems and telemetry to discover threats that may not have triggered existing alerts. Analysts can search for unusual commands, persistence mechanisms, or indicators associated with an attack.

10. What is the purpose of an EDR investigation timeline?

To calculate employee salaries
To arrange relevant endpoint events chronologically for incident analysis
To schedule software purchases
To measure physical network cable lengths

Answer: B) To arrange relevant endpoint events chronologically for incident analysis

Explanation:

A timeline helps analysts understand the sequence of events, such as the initial execution of a malicious file, the creation of a child process, a suspicious network connection, and subsequent changes to system files.

11. Which event is particularly useful for reconstructing a process execution chain?

A monitor's screen size
A computer's desk location
Process creation events containing parent-child relationships
The number of keys on a keyboard

Answer: C) Process creation events containing parent-child relationships

Explanation:

Parent-child process relationships show which process launched another process. For example, a document reader launching a script interpreter unexpectedly may indicate suspicious activity and deserves further investigation.

12. What is a false positive in EDR detection?

A confirmed malicious activity that was correctly identified
A security alert that always proves a device is compromised
A legitimate event that was never monitored
A benign activity incorrectly classified as suspicious or malicious

Answer: D) A benign activity incorrectly classified as suspicious or malicious

Explanation:

A false positive occurs when legitimate activity triggers an incorrect threat classification. Analysts investigate alerts to distinguish actual attacks from normal administrative tools, authorized scripts, and other benign behavior.

13. What is a false negative in endpoint threat detection?

A malicious activity that the detection system fails to identify
A benign event that triggers an alert
A successfully contained security incident
A confirmed vulnerability that has been patched

Answer: A) A malicious activity that the detection system fails to identify

Explanation:

A false negative occurs when a real threat goes undetected. It may result from missing telemetry, detection gaps, evasion techniques, incomplete rules, or activity that does not match the system's detection logic.

14. Why is command-line information valuable in EDR investigations?

It determines the physical weight of a computer
It can reveal commands, scripts, arguments, and suspicious execution patterns
It replaces all endpoint event logs
It guarantees that every command is malicious

Answer: B) It can reveal commands, scripts, arguments, and suspicious execution patterns

Explanation:

Command-line details can show how a program was launched and what arguments it received. Encoded commands, unexpected downloads, or unusual script execution may provide important investigative clues, but context is necessary to establish malicious intent.

15. What does the principle of least privilege mean for endpoint security?

Every user must have administrator privileges
All security tools must operate without access controls
Users and processes should receive only the permissions needed for their tasks
Every application must be allowed to modify system settings

Answer: C) Users and processes should receive only the permissions needed for their tasks

Explanation:

Least privilege reduces the damage an attacker can cause after compromising an account or process. EDR can help identify suspicious privilege use, while operating system controls and identity security enforce appropriate permissions.

16. Which behavior may indicate ransomware activity on an endpoint?

Opening a normal text document
Changing the desktop wallpaper through an approved personalization setting
Installing an authorized operating system update
Rapidly modifying or encrypting many files and creating ransom notes

Answer: D) Rapidly modifying or encrypting many files and creating ransom notes

Explanation:

Ransomware often modifies large numbers of files, changes extensions, and creates ransom notes. EDR can detect suspicious file activity and, when supported, stop processes or isolate affected endpoints to limit further damage.

17. What is the purpose of threat intelligence in an EDR platform?

To provide contextual information about suspicious indicators, tools, and known threats
To replace the endpoint operating system
To guarantee that every external IP address is malicious
To manage office inventory

Answer: A) To provide contextual information about suspicious indicators, tools, and known threats

Explanation:

Threat intelligence can enrich endpoint alerts with information about malicious file hashes, domains, IP addresses, or attacker techniques. Indicators must still be evaluated in context because they can be outdated, shared, or associated with legitimate services.

18. What is the role of a file hash during an EDR investigation?

It reveals the exact physical location of a file on a disk without other information
It provides a fingerprint that can help identify and compare file contents
It automatically proves the identity of the file's author
It encrypts all network traffic from the endpoint

Answer: B) It provides a fingerprint that can help identify and compare file contents

Explanation:

Cryptographic hashes such as SHA-256 can help analysts compare files and check them against known indicators. A matching hash supports identification of identical content, but a hash alone does not establish whether a file is safe or malicious.

19. Why might an EDR platform monitor connections to unusual external destinations?

To determine a user's preferred screen brightness
To identify the brand of the endpoint's keyboard
To help detect command-and-control communication or suspicious data transfers
To automatically classify every external connection as malicious

Answer: C) To help detect command-and-control communication or suspicious data transfers

Explanation:

Malware may contact remote infrastructure to receive commands, download additional payloads, or exfiltrate data. EDR network telemetry can help analysts investigate unusual destinations and correlate connections with the responsible processes.

20. What is meant by persistence in a cybersecurity attack?

Temporarily opening an ordinary application
Shutting down a computer for maintenance
Removing all unauthorized software from a device
Establishing a mechanism that allows an attacker or malware to remain or regain access

Answer: D) Establishing a mechanism that allows an attacker or malware to remain or regain access

Explanation:

Attackers may establish persistence through unauthorized scheduled tasks, startup entries, services, or other mechanisms. EDR can monitor changes to these locations and help investigators identify suspicious modifications.

21. How can EDR help detect credential theft?

By identifying suspicious access to credential-related processes, memory, or authentication data
By recording the color of every application window
By disabling all user accounts permanently
By replacing multifactor authentication with a password list

Answer: A) By identifying suspicious access to credential-related processes, memory, or authentication data

Explanation:

Credential theft may involve suspicious process access, memory inspection, credential-dumping tools, or unusual authentication activity. EDR can identify related endpoint behavior, although dedicated identity security controls provide additional visibility.

22. What is a major benefit of correlating multiple endpoint events?

It eliminates the need for security investigations
It can reveal an attack sequence that individual events might not clearly expose
It guarantees that no alerts will be generated
It prevents every legitimate program from executing

Answer: B) It can reveal an attack sequence that individual events might not clearly expose

Explanation:

Event correlation connects related observations, such as a suspicious email attachment, a newly launched process, an unusual script, and an outbound connection. Together, these events may reveal an attack pattern more clearly than any one event alone.

23. Which response action is appropriate when an EDR investigation confirms a malicious process is actively harming a system?

Ignore the alert until the next scheduled review
Delete all enterprise backups immediately
Terminate the malicious process when appropriate and contain the endpoint as needed
Disable monitoring on every endpoint

Answer: C) Terminate the malicious process when appropriate and contain the endpoint as needed

Explanation:

Stopping a confirmed malicious process can prevent further harmful activity. Analysts should also assess whether isolation, evidence preservation, credential resets, or broader containment is needed, following the organization's incident response procedures.

24. What is the purpose of an allowlist in endpoint security?

To approve every file regardless of its behavior
To ensure that all internet downloads are automatically trusted
To prevent security analysts from reviewing events
To define items or activities that are permitted under specified security rules

Answer: D) To define items or activities that are permitted under specified security rules

Explanation:

An allowlist specifies approved applications, files, or activities according to configured criteria. Poorly maintained allowlists can create security gaps, especially if an approved application is compromised or can be misused by an attacker.

25. Why is it important to investigate an EDR alert before closing it?

To determine whether the activity is malicious, benign, or requires additional investigation
To ensure that all alerts are classified as false positives
To prevent analysts from collecting supporting evidence
To guarantee that the endpoint never produces another alert

Answer: A) To determine whether the activity is malicious, benign, or requires additional investigation

Explanation:

Alert investigation validates the detection, examines related events, and establishes the likely impact. Closing alerts without sufficient analysis can leave real threats unresolved or create inaccurate incident records.

26. Which statement best describes endpoint forensic evidence?

It consists only of employee opinions about an incident
It includes relevant records and artifacts that help reconstruct and verify endpoint activity
It is always limited to screenshots of the desktop
It has no value after a device is isolated

Answer: B) It includes relevant records and artifacts that help reconstruct and verify endpoint activity

Explanation:

Forensic evidence may include process records, event logs, file metadata, registry changes, and other artifacts. Investigators should preserve evidence carefully, document collection procedures, and maintain integrity and chain of custody where required.

27. What does Mean Time to Detect (MTTD) measure in security operations?

The number of endpoint agents installed
The amount of storage used by endpoint logs
The average time taken to detect an incident after its defined starting point
The time required to purchase new endpoint hardware

Answer: C) The average time taken to detect an incident after its defined starting point

Explanation:

MTTD measures how long it takes to identify an incident under the organization's chosen measurement definition. Lower detection time can reduce the period during which an attacker operates without being identified.

28. What does Mean Time to Respond (MTTR) generally measure in security incident management?

The number of files scanned each day
The percentage of endpoints using a particular operating system
The time needed to create an endpoint inventory
The average time taken to respond to an incident, according to the organization's defined measurement

Answer: D) The average time taken to respond to an incident, according to the organization's defined measurement

Explanation:

MTTR is used to evaluate incident handling speed, but organizations may define the endpoint of measurement differently, such as response initiation, containment, or recovery. A clear definition is necessary for meaningful comparisons.

29. Which capability helps EDR identify potentially malicious activity that has no known file signature?

Behavior-based detection of suspicious process and system activity
Automatic deletion of all unsigned documents
Changing the endpoint's display resolution
Measuring the computer's physical dimensions

Answer: A) Behavior-based detection of suspicious process and system activity

Explanation:

Behavior-based detection can identify suspicious actions even when a file is previously unknown. For example, unusual memory access, suspicious scripting, or abnormal persistence activity may be detected through behavioral rules and analytics.

30. What is fileless malware?

Malware that can operate only on computers without storage devices
Malicious activity that relies heavily on legitimate system tools or memory-based execution rather than a conventional malicious file on disk
Software that is always harmless because it has no filename
A legitimate file that has been compressed

Answer: B) Malicious activity that relies heavily on legitimate system tools or memory-based execution rather than a conventional malicious file on disk

Explanation:

Fileless techniques may abuse interpreters, scripts, legitimate administration tools, or memory-resident code. EDR can detect associated behaviors and process relationships, even when traditional file-based scanning provides limited evidence.

31. What is the primary purpose of an EDR management console?

To control building lighting systems only
To print documents without user interaction
To provide a centralized interface for endpoint visibility, alerts, investigations, and response
To replace all operating system user interfaces

Answer: C) To provide a centralized interface for endpoint visibility, alerts, investigations, and response

Explanation:

The management console allows security teams to review alerts, search telemetry, inspect endpoint status, investigate incidents, and initiate supported response actions across managed devices.

32. Why should organizations monitor the health of their EDR agents?

To guarantee that all applications run without errors
To determine employee performance ratings
To measure the size of every installed monitor
To identify endpoints with inactive, outdated, misconfigured, or unhealthy security agents

Answer: D) To identify endpoints with inactive, outdated, misconfigured, or unhealthy security agents

Explanation:

An unhealthy or disconnected agent may create a visibility gap. Monitoring agent status, policy compliance, version information, and telemetry delivery helps security teams identify endpoints that may not be adequately protected.

33. What is the purpose of MITRE ATT&CK mapping in EDR investigations?

To classify observed adversary behaviors using a structured knowledge base of tactics and techniques
To assign permanent IP addresses to all endpoints
To replace all incident evidence with a single score
To guarantee that every attack follows the same sequence

Answer: A) To classify observed adversary behaviors using a structured knowledge base of tactics and techniques

Explanation:

MITRE ATT&CK organizes documented adversary tactics and techniques. Mapping observed behavior to ATT&CK helps analysts describe attack activity, identify potential detection gaps, and communicate investigation findings consistently.

34. Which statement best distinguishes EDR from Endpoint Protection Platform (EPP)?

EPP can only protect network routers, while EDR protects printers
EPP generally emphasizes preventive endpoint protection, while EDR emphasizes ongoing detection, investigation, and response; modern products often combine both
EDR cannot run on endpoint devices
EPP and EDR are required to perform completely unrelated functions

Answer: B) EPP generally emphasizes preventive endpoint protection, while EDR emphasizes ongoing detection, investigation, and response; modern products often combine both

Explanation:

EPP commonly provides preventive capabilities such as antivirus, exploit prevention, and application control. EDR focuses on visibility into endpoint behavior and incident investigation and response. Many endpoint security products integrate these capabilities.

35. What does Extended Detection and Response (XDR) generally add to endpoint-focused detection?

Only additional keyboard shortcuts
Exclusive monitoring of printed documents
Correlation of security data across multiple domains, such as endpoints, networks, email, and cloud services
Removal of all endpoint telemetry

Answer: C) Correlation of security data across multiple domains, such as endpoints, networks, email, and cloud services

Explanation:

XDR broadens detection and investigation by combining signals from multiple security layers. This cross-domain view can help reveal incidents that are difficult to understand using endpoint events alone.

36. Why is time synchronization important during an EDR investigation?

It prevents every type of malware infection
It automatically validates every alert as accurate
It removes the need to collect logs from endpoints
It helps analysts correlate events from different systems in the correct chronological order

Answer: D) It helps analysts correlate events from different systems in the correct chronological order

Explanation:

Accurate and consistently interpreted timestamps help investigators connect endpoint events with identity, network, and cloud records. Clock differences or timezone misunderstandings can otherwise make an incident timeline misleading.

37. What should an analyst consider before isolating a critical production server?

The security risk, business impact, available containment alternatives, and incident response procedures
Only the server's desktop wallpaper
Whether the server's hostname is easy to pronounce
Whether every employee has logged out of personal email

Answer: A) The security risk, business impact, available containment alternatives, and incident response procedures

Explanation:

Isolation can limit an attack but may interrupt essential services. Responders should weigh the urgency of containment against operational consequences and follow approved procedures, while choosing the fastest safe action for the incident's severity.

38. What is a key security concern when attackers attempt to disable an EDR agent?

The endpoint will always become physically damaged
The endpoint may lose security visibility and become easier to compromise further
All previously collected evidence is guaranteed to be destroyed
The operating system will automatically become fully patched

Answer: B) The endpoint may lose security visibility and become easier to compromise further

Explanation:

Attackers may attempt to tamper with security services, terminate processes, or interfere with telemetry collection. Tamper protection, access controls, health monitoring, and alerts for agent disruption help reduce this risk.

39. Why is application control useful alongside EDR?

It guarantees that all approved software is free of vulnerabilities
It replaces the need for user authentication
It can restrict execution to applications that satisfy defined trust or policy requirements
It automatically repairs every compromised endpoint

Answer: C) It can restrict execution to applications that satisfy defined trust or policy requirements

Explanation:

Application control can reduce the execution of unauthorized or untrusted software. EDR complements it by monitoring behavior and investigating suspicious activity, including misuse of otherwise permitted applications.

40. What is the purpose of a containment phase in incident response?

To erase every log before an investigation begins
To close all security incidents without verification
To permanently disable every endpoint in the organization
To limit the spread or impact of an active threat while investigation and remediation continue

Answer: D) To limit the spread or impact of an active threat while investigation and remediation continue

Explanation:

Containment aims to prevent further damage, such as lateral movement, additional compromise, or data theft. Depending on the incident, actions may include endpoint isolation, blocking malicious indicators, or disabling compromised accounts.

41. What is the main advantage of collecting endpoint telemetry centrally?

It supports centralized searching, correlation, alerting, and investigation across multiple devices
It eliminates the need for access controls
It ensures that every endpoint has identical user activity
It prevents all hardware failures

Answer: A) It supports centralized searching, correlation, alerting, and investigation across multiple devices

Explanation:

Centralized telemetry enables analysts to search across an endpoint fleet, compare events, and identify patterns that may indicate a coordinated attack. Collection, retention, and access should be configured to meet security and privacy requirements.

42. Which practice helps protect sensitive data collected by an EDR platform?

Giving every employee unrestricted access to all telemetry
Applying role-based access controls, appropriate retention policies, and encryption where supported
Publishing all endpoint logs on a public website
Disabling audit records for administrator actions

Answer: B) Applying role-based access controls, appropriate retention policies, and encryption where supported

Explanation:

Endpoint telemetry can contain usernames, command-line arguments, file paths, and other sensitive information. Restricting access, protecting stored and transmitted data, and retaining records only as needed help reduce privacy and security risks.

43. How can an EDR solution help investigate a suspicious PowerShell command?

By assuming that every PowerShell command is malicious
By checking only the computer's screen resolution
By examining command-line arguments, the parent process, user context, and related events
By deleting every script on all managed endpoints

Answer: C) By examining command-line arguments, the parent process, user context, and related events

Explanation:

PowerShell is used for legitimate administration as well as attacks. Reviewing the command, its origin, execution context, script behavior, and associated network activity helps determine whether the activity is authorized or suspicious.

44. Why should security teams validate an indicator of compromise (IOC) before taking broad blocking actions?

Because IOCs are never useful for detection
Because all indicators automatically expire after one hour
Because a valid IOC always identifies every compromised endpoint
Because indicators may be outdated, shared by legitimate services, or insufficient without additional context

Answer: D) Because indicators may be outdated, shared by legitimate services, or insufficient without additional context

Explanation:

Indicators such as IP addresses, domains, and file hashes can support detection, but they are not always definitive. Validation helps prevent unnecessary disruption while ensuring that relevant malicious activity is properly investigated.

45. What is the primary purpose of automated response playbooks in EDR?

To execute predefined investigation or response steps when specified conditions are met
To replace all security policies with random decisions
To prevent analysts from reviewing high-severity incidents
To guarantee that automated actions can never cause disruption

Answer: A) To execute predefined investigation or response steps when specified conditions are met

Explanation:

Response playbooks can automate tasks such as enriching alerts, collecting additional evidence, or isolating endpoints under defined conditions. Testing, permissions, approval requirements, and rollback procedures help reduce the risk of inappropriate automated actions.

46. What should an organization do after removing malware from a compromised endpoint?

Assume that the attacker has lost every form of access without further checks
Verify remediation, investigate persistence and related compromise, and restore the endpoint according to recovery procedures
Immediately disable all security logging
Ignore potentially compromised credentials

Answer: B) Verify remediation, investigate persistence and related compromise, and restore the endpoint according to recovery procedures

Explanation:

Removing a malicious file does not necessarily eliminate an attacker's access. Responders should check for persistence, assess possible credential compromise, investigate other affected systems, apply necessary fixes, and confirm that the endpoint is safe to return to service.

47. Which metric can help evaluate how effectively an EDR team handles incoming alerts?

The number of desktop icons on each endpoint
The total number of keyboards in the office
Alert triage time, investigation backlog, and the proportion of alerts resolved within defined targets
The number of screensavers installed

Answer: C) Alert triage time, investigation backlog, and the proportion of alerts resolved within defined targets

Explanation:

Operational metrics help teams assess workload, response speed, and adherence to service targets. These measurements should be interpreted alongside detection quality and incident outcomes rather than optimizing alert closure speed alone.

48. Why is it important to retain endpoint logs for an appropriate period?

To guarantee that endpoints never need security updates
To increase the number of false positives intentionally
To prevent investigators from examining older activity
To support retrospective investigations, incident timelines, and compliance requirements

Answer: D) To support retrospective investigations, incident timelines, and compliance requirements

Explanation:

Attackers may remain undetected for an extended period before an incident is discovered. Retaining relevant telemetry can help analysts investigate earlier activity, subject to storage limits, organizational policy, legal obligations, and privacy requirements.

49. Which sequence best represents a typical EDR investigation and response workflow?

Detect suspicious activity, investigate evidence, assess impact, contain the threat, remediate, and verify recovery
Delete all logs, disable endpoint agents, and close the incident
Restore every endpoint before identifying the threat
Ignore alerts until every endpoint is affected

Answer: A) Detect suspicious activity, investigate evidence, assess impact, contain the threat, remediate, and verify recovery

Explanation:

A structured workflow helps teams establish what happened, determine the scope of compromise, limit damage, remove the threat, and verify recovery. The exact order can vary when immediate containment is necessary to prevent ongoing harm.

50. An EDR platform detects a suspicious script on a workstation. Investigation shows that the script was launched by an unexpected document-reading process, created a command shell, and connected to an unfamiliar external server. The workstation then began modifying many files rapidly. What is the most appropriate response?

Close the alert because document readers and command shells are always legitimate
Ignore the file modifications until the next scheduled endpoint scan
Investigate the correlated process and network activity, contain the endpoint promptly, preserve relevant evidence, and begin incident remediation
Disable EDR across the organization to avoid generating additional alerts

Answer: C) Investigate the correlated process and network activity, contain the endpoint promptly, preserve relevant evidence, and begin incident remediation

Explanation:

The unexpected process chain, unfamiliar external connection, and rapid file modifications collectively suggest a possible active attack, including ransomware or malware delivery. The security team should prioritize containment to limit further damage, preserve available evidence, investigate the scope of compromise, and remediate affected systems. Individual events can have legitimate explanations, but their combination warrants urgent investigation.

Comments and Discussions!

Load comments ↻

Endpoint Detection and Response (EDR) MCQs (Multiple-Choice Questions)