5.4 Explain Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is evaluating a new endpoint security tool. They need to detect fileless attacks that leave no signature and respond to threats that are already running in memory. Their current antivirus solution has failed to detect these attacks. What is the most important capability the new tool must have?

   • ASignature-based detection with frequent updates
   • BApplication allowlisting
   • CNetwork traffic analysis
   • DBehavioral analysis and memory inspection
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After detecting a malicious file on an endpoint, an analyst wants to prevent the file from executing on other endpoints while allowing the security team to analyze it. Which EDR response action is most appropriate?

   • ADelete the file from all endpoints
   • BAdd the file hash to a blocklist
   • CReboot all endpoints
   • DDisable the endpoint's user account
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An organization has a mature EDR deployment but is experiencing alert fatigue because the EDR generates many alerts that are not related to actual threats. They want to reduce noise while improving detection of multi-stage attacks. What is the most effective approach?

   • AIncrease the sensitivity of the EDR detection rules
   • BImplement an XDR solution that correlates EDR alerts with network and cloud data
   • CDisable EDR alerts for low-risk endpoints
   • DReplace the EDR with a traditional antivirus
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How does EDR differ from traditional antivirus in its approach to threat detection?

   • AEDR only prevents known malware, while antivirus can detect unknown threats
   • BEDR and antivirus use identical detection methods but different deployment models
   • CEDR relies solely on signature-based detection, while antivirus uses behavioral analysis
   • DEDR uses behavioral analysis and continuous monitoring, while antivirus primarily uses signature-based detection
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which security layer is typically included in XDR but NOT in EDR?

   • ANetwork traffic analysis
   • BBehavioral analysis of endpoint processes
   • CFile integrity monitoring on endpoints
   • DEndpoint process monitoring
   Reveal Solution Discussion Select an answer first