100-160 Question 110
Select 4A company’s security team has implemented endpoint detection and response (EDR) software across all employee devices. However, one employee reports that their device's EDR tool is not functioning correctly. Upon investigation, it is discovered that the EDR tool is disabled, and the employee's device has been infected with malware. What should the security team do to effectively address and prevent this issue from happening again?
- A
Ensure all endpoints have proper administrative controls to prevent users from disabling security tools.
- B
Reinstall the EDR software on the affected device and run a full system scan.
- C
Isolate the affected device from the network immediately to prevent further spread of malware.
- D
Configure the EDR software to log all user activity on every endpoint.
- E
Conduct regular employee training on the importance of endpoint security and recognizing potential threats.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Endpoint security encompasses both technical measures and user awareness. To address the issue, the security team should implement controls to prevent tampering with security tools, remediate the infected device, isolate it to prevent further spread, and educate employees about cybersecurity best practices. Logging user activity, while useful, is not as directly impactful in this scenario.
- A. Correct.
Ensuring proper administrative controls prevents users from disabling critical security tools, reducing the risk of unprotected devices.
- B. Correct.
Reinstalling the EDR software and performing a full scan helps remove the malware and restore the device’s security.
- C. Correct.
Isolating the infected device is a critical step to contain the malware and stop it from spreading to other systems.
- D. Incorrect.
While logging user activity can provide insights into potential threats, it is not a direct measure for preventing or mitigating this specific issue.
- E. Correct.
Training employees on endpoint security helps increase awareness and reduces the likelihood of similar incidents caused by user actions.