SY0-701 Question 338
Single answerEndpoint detection and response (EDR)/extended detection and response (XDR)A security analyst is investigating a phishing incident in which a user opened a malicious attachment on a corporate laptop. The organization's EDR platform detected suspicious PowerShell activity on the endpoint, but the analyst now needs to determine whether the attacker also used the compromised account to move laterally through cloud email and identity services. Which solution would BEST improve the analyst's ability to correlate this activity across endpoints, identity, and email systems from a single investigation workflow?
- A
Deploy an XDR solution that ingests and correlates telemetry from endpoint, identity, and email security controls
- B
Enable full-disk encryption on all corporate laptops to prevent malicious scripts from executing after a user opens them
- C
Replace the EDR platform with a host-based firewall that blocks outbound PowerShell connections
- D
Configure weekly vulnerability scans to identify unpatched systems that may have received the phishing email
Show answer and explanation
Correct answer: A
Explanation
The key distinction is that EDR focuses primarily on endpoint telemetry, detection, and response, while XDR broadens that capability by integrating multiple security data sources into a more unified detection and investigation process. In a phishing scenario, attackers often move beyond the initial host and abuse credentials in email or identity systems. A security team using only EDR may see the local process activity but miss or struggle to correlate related events in cloud services unless those data sources are separately reviewed. XDR is intended to improve this by correlating indicators across endpoints, identity, email, network, and other security layers. This aligns with common industry guidance from major security vendors and frameworks such as NIST incident response recommendations, which emphasize centralized visibility, event correlation, and timely investigation across relevant log sources.
- A. Correct.
Correct. XDR extends detection and response beyond a single control point such as the endpoint. It is designed to aggregate and correlate telemetry from multiple security layers, commonly including endpoints, identity sources, email, network, and cloud workloads. In this scenario, the analyst needs visibility into endpoint behavior and potential account misuse in cloud email and identity services. XDR best supports that broader investigation from a unified workflow.
- B. Incorrect.
Incorrect. Full-disk encryption protects data at rest if a device is lost or stolen, but it does not provide cross-domain detection or correlation of malicious activity. It also does not stop a user from opening a malicious attachment or prevent a script from running simply because the disk is encrypted.
- C. Incorrect.
Incorrect. A host-based firewall can restrict certain traffic patterns, but it is not a replacement for EDR and does not provide the broader telemetry correlation the analyst needs. In addition, blocking outbound PowerShell connections addresses only one possible behavior and would not help determine whether the compromised account was abused in cloud email or identity platforms.
- D. Incorrect.
Incorrect. Vulnerability scanning is useful for identifying missing patches and weak configurations, but it does not correlate endpoint, identity, and email events for incident response. This option focuses on exposure management rather than the immediate need to investigate attacker activity across multiple control domains.