5.1 Describe Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) Solutions 350-701 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A large enterprise is evaluating endpoint security solutions. They have a mature SOC that performs proactive threat hunting and a strict change-management process that requires minimal disruption to business operations. They need to block known malware and also detect sophisticated, fileless attacks. Which solution would best meet these needs?

   • AA network-based intrusion prevention system (IPS)
   • BAn EDR solution with continuous monitoring and threat hunting
   • CAn EPP solution with advanced heuristics and application control
   • DAn integrated EPP/EDR solution with a single agent
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security analyst is investigating an alert about a suspicious process that has been running for several days. The process is not flagged by the EPP, and the analyst needs to determine if it is malicious. The analyst has access to an EDR console. Which action would provide the most useful information?

   • AReboot the endpoint to clear the process
   • BReview the process's behavior and network connections in the EDR
   • CCheck the EPP's signature database for the process
   • DDisable the EPP to allow the process to run
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   An EDR solution has detected a suspicious process on an endpoint. Which of the following actions is most characteristic of an EDR's response capability?

   • ABlocking all outbound traffic at the firewall
   • BQuarantining the affected endpoint from the network
   • CRebuilding the operating system from a golden image
   • DUpdating the antivirus signature database
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a core capability of an Endpoint Protection Platform (EPP)?

   • ASignature-based antivirus scanning
   • BForensic analysis of memory dumps
   • CAutomated incident response playbooks
   • DReal-time threat hunting across the network
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How do EPP and EDR solutions complement each other when integrated?

   • AEPP and EDR are redundant, and using both is unnecessary.
   • BEPP blocks known threats, while EDR detects and responds to unknown or evasive threats.
   • CEPP is used for network security, while EDR is used for endpoint security.
   • DEPP provides detection and response, while EDR provides prevention.
   Reveal Solution Discussion Select an answer first