100-160 Question 123
Select 3A security analyst has been tasked with assessing the security posture of several company endpoints. Which tools would be most appropriate to gather security assessment information?
- A
Endpoint Detection and Response (EDR) solutions
- B
Vulnerability scanners
- C
Network traffic analysis tools
- D
Antivirus software
- E
Web application firewalls (WAF)
Show answer and explanation
Correct answers: A, B, D
Explanation
To gather security assessment information on endpoints, tools like Endpoint Detection and Response (EDR) solutions, vulnerability scanners, and antivirus software are most appropriate. EDR provides in-depth endpoint telemetry and behavioral analysis, vulnerability scanners identify weaknesses, and antivirus software detects malware threats. Network traffic tools and WAFs are more focused on network and web application security, respectively, and are not ideal for endpoint-focused assessments.
- A. Correct.
Endpoint Detection and Response (EDR) solutions are specifically designed to monitor endpoints for suspicious behavior, collect telemetry data, and provide detailed insights into endpoint activity. This makes them valuable for security assessment.
- B. Correct.
Vulnerability scanners are used to identify security weaknesses and misconfigurations on endpoints, providing critical information for assessing the endpoint's security posture.
- C. Incorrect.
Network traffic analysis tools focus on monitoring and analyzing network communications rather than assessing endpoint-specific security information, making them less relevant for this task.
- D. Correct.
Antivirus software can detect and remove known malware threats on endpoints, providing essential security assessment information related to malware presence and activity.
- E. Incorrect.
Web application firewalls (WAF) protect web applications and do not gather endpoint-specific security assessment information, so they are not suitable in this scenario.