Cyber Attacks and Defense in Practice
Which of the following correctly describes EDR (endpoint detection and response) compared with traditional antivirus software?
- AIt continuously records behavior on endpoints, such as process launches and network connections, detects suspicious activity and supports responses such as isolating the device
- BIt only checks whether files match the characteristics of known malware and deletes the files that match, without recording behavior
- CIt is placed at the network perimeter rather than on endpoints and blocks packets arriving from outside based on IP addresses and port numbers
Show answer and explanation
Answer: A. It continuously records behavior on endpoints, such as process launches and network connections, detects suspicious activity and supports responses such as isolating the device
Traditional antivirus software mainly compares files against the characteristics of known malware and aims to stop intrusion at the point of entry. EDR assumes that intrusion cannot be prevented completely and continuously records process launches, changes to files and settings, network connections and so on at the endpoint to detect suspicious behavior. Its features include going back through the records to investigate the intrusion path and the extent of the impact, remotely isolating the device from the network and stopping suspicious processes. Many products today provide antivirus functions and EDR in one.
- A. Correct. Recording and detecting behavior and supporting investigation and response are the role of EDR.
- B. This mainly describes traditional antivirus software. It tends to miss unknown malware and attacks that abuse legitimate tools.
- C. Blocking traffic at the network perimeter is the role of firewalls and IPSs.
Continue: 9 more Cyber Attacks and Defense in Practice questions