5.4 Explain Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) CYBERSECURITY-PRACTITIONER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team needs to understand the full timeline of an attack, including what files were created, what processes ran, and what network connections were made on an endpoint. Which EDR capability provides this information?

   • AVulnerability scanning
   • BApplication allowlisting
   • CContinuous monitoring and recording of endpoint activity
   • DNetwork firewall rules
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security architect is deciding between EDR and XDR. The organization has a mature endpoint security program but needs to improve visibility into network and cloud threats. What is the primary advantage of XDR over EDR in this scenario?

   • AXDR replaces the need for a SIEM
   • BXDR is easier to deploy than EDR
   • CXDR only works in cloud environments
   • DXDR provides broader visibility by correlating data from multiple security layers
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   During an incident response, an analyst needs to contain a threat that is spreading laterally across multiple endpoints. The analyst wants to stop the spread while preserving the ability to investigate the attack. Which action is most appropriate?

   • AReboot all affected endpoints
   • BDelete the malicious files from all endpoints
   • CDisable the user accounts associated with the affected endpoints
   • DIsolate the affected endpoints from the network
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which activity is an example of threat hunting supported by EDR or XDR?

   • AUpdating antivirus signatures on all endpoints
   • BConducting user security awareness training
   • CWaiting for automated alerts to trigger before taking any action
   • DProactively searching for indicators of compromise using endpoint and network data
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's security team is evaluating a new tool. They need a solution that not only blocks known malware but also records endpoint activity, detects suspicious behavior, and allows them to investigate and respond to incidents. How does EDR differ from traditional antivirus in this context?

   • AEDR is a signature-based tool that requires daily updates
   • BEDR only works on cloud workloads, not on-premises endpoints
   • CEDR provides continuous monitoring and response capabilities beyond signature-based blocking
   • DEDR replaces the need for any other security controls
   Reveal Solution Discussion Select an answer first