Endpoint Detection and Response (EDR) in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary function of Endpoint Detection and Response (EDR)?

Choose the best description of what EDR systems mainly do in cybersecurity.

A They monitor and collect data from endpoints to detect and respond to threats in real-time.

B They replace firewalls by blocking all incoming network traffic.

C They encrypt all data stored on endpoints to prevent unauthorized access.

D They manage user passwords and authentication across the network.

💡 Hint

Think about how EDR helps protect devices by watching their activity closely.

EDR tools focus on monitoring endpoint devices continuously to detect suspicious behavior and respond quickly to threats. They do not replace firewalls, encrypt data by default, or manage passwords.

📋 Factual

intermediate

Which of the following is NOT a typical feature of EDR solutions?

Select the option that is generally not included in EDR capabilities.

A Continuous monitoring of endpoint activities.

B Real-time alerting on suspicious behavior.

C Centralized patch management for all software.

D Automated threat hunting and investigation.

💡 Hint

Consider which task is usually handled by separate management tools, not EDR.

Patch management is typically handled by dedicated tools or endpoint management systems, not by EDR solutions. EDR focuses on monitoring, detecting, and responding to threats.

🔍 Analysis

advanced

Analyzing EDR alert data: What does a sudden spike in file modifications on multiple endpoints likely indicate?

You notice many endpoints suddenly have a high number of file changes reported by the EDR. What is the most likely explanation?

A A ransomware attack encrypting files across devices.

B Users are performing routine backups manually.

C A scheduled system update or patch deployment is occurring.

D The EDR sensors are malfunctioning and reporting false data.

💡 Hint

Think about what kind of attack causes many files to change quickly and unexpectedly.

Ransomware typically encrypts many files rapidly, causing a spike in file modifications detected by EDR. Scheduled updates or backups usually happen in controlled ways and are known events.

❓ Comparison

advanced

How does EDR differ from traditional antivirus software?

Choose the option that best explains the key difference between EDR and traditional antivirus.

A Antivirus can detect zero-day threats better than EDR systems.

B EDR provides continuous monitoring and response, while antivirus mainly relies on signature-based detection.

C EDR only protects servers, while antivirus protects all devices.

D Antivirus software automatically removes all detected threats without user input.

💡 Hint

Consider how EDR and antivirus handle threat detection and response differently.

Traditional antivirus mostly uses known threat signatures and scans periodically, while EDR continuously monitors endpoint behavior and can detect unknown threats and respond in real-time.

❓ Reasoning

expert

Why is integrating EDR with Security Information and Event Management (SIEM) systems beneficial?

What is the main advantage of combining EDR data with SIEM platforms in an organization's security setup?

A It reduces the amount of data collected from endpoints to save storage space.

B It replaces the need for firewalls and intrusion prevention systems.

C It automatically fixes all endpoint vulnerabilities without human intervention.

D It allows centralized analysis of endpoint data alongside network and user activity for better threat detection.

💡 Hint

Think about how combining different data sources helps security teams understand threats better.

Integrating EDR with SIEM enables security teams to correlate endpoint events with other logs like network traffic and user behavior, improving detection and investigation of complex attacks.