100-160 Question 109
Single answerA company's IT team has implemented endpoint detection and response (EDR) software on all corporate devices to enhance security. Shortly after, the EDR system alerts that an employee's device has been compromised by a suspicious executable file downloaded from an email attachment. What is the MOST appropriate next step for the IT team to take?
- A
Isolate the compromised device from the network immediately.
- B
Delete the suspicious executable file from the compromised device.
- C
Update the EDR software on all corporate devices to the latest version.
- D
Reboot the compromised device to terminate the suspicious process.
Show answer and explanation
Correct answer: A
Explanation
When an endpoint is compromised, the primary goal is to contain the threat to prevent further damage. Isolating the device from the network ensures that the threat cannot propagate to other systems or access sensitive information. Other steps, such as malware removal or forensic analysis, should follow after containment.
- A. Correct.
Isolating the compromised device from the network immediately prevents the potential spread of malware or unauthorized access to other systems, making it the most appropriate first step.
- B. Incorrect.
Deleting the suspicious executable file may remove the immediate threat but does not address the possibility that other malicious actions have already occurred. This is not the most effective initial step.
- C. Incorrect.
Updating the EDR software is a good security practice but is not an immediate response to a detected compromise. This action would not directly address the threat.
- D. Incorrect.
Rebooting the device might terminate the suspicious process temporarily, but it does not guarantee removal of the malware and could erase forensic evidence required for investigation.