100-160 Question 106
Single answerA company’s IT team has deployed an endpoint detection and response (EDR) solution across all employee devices. Shortly after, an alert is triggered indicating that a malicious file has been downloaded onto one of the devices. What is the MOST appropriate action to take as part of endpoint security best practices?
- A
Quarantine the affected device to prevent further spread of the malicious file.
- B
Immediately shut down the EDR system to avoid further alerts.
- C
Ignore the alert, as it might be a false positive.
- D
Disable all network connections for the affected device and investigate the alert.
Show answer and explanation
Correct answer: D
Explanation
Effective endpoint security requires a swift response to potential threats. By disabling all network connections for the affected device, the IT team ensures containment and prevents further damage while investigating the nature of the alert. This approach aligns with endpoint security best practices and minimizes risk to the organization.
- A. Incorrect.
Quarantining the affected device is a valid option, but immediately disabling all network connections provides a broader containment strategy and ensures no data exfiltration or further spread of malware occurs.
- B. Incorrect.
Shutting down the EDR system would hinder visibility into the incident and prevent further defense actions, which is not a recommended practice.
- C. Incorrect.
Ignoring the alert would leave the potential threat unaddressed, exposing the network to risk.
- D. Correct.
Disabling all network connections for the affected device is the most appropriate first step to isolate the threat and prevent it from spreading while the IT team investigates the alert.