Broadcom 250-580 Exam - Topic 2 Question 14 Discussion

Actual exam question for Broadcom's 250-580 exam

Question #: 14
Topic #: 2

An Incident Responder has determined that an endpoint is compromised by a malicious threat. What SEDR feature would be utilized first to contain the threat?

AFile Deletion

BIncident Manager

CIsolation

DEndpoint Activity Recorder

Show Suggested Answer

Suggested Answer: C

When an Incident Responder determines that an endpoint is compromised, the first action to contain the threat is to use the Isolation feature in Symantec Endpoint Detection and Response (SEDR). Isolation effectively disconnects the affected endpoint from the network, thereby preventing the malicious threat from communicating with other systems or spreading within the network environment. This feature enables the responder to contain the threat swiftly, allowing further investigation and remediation steps to be conducted without risk of lateral movement by the attacker.

by Lauran at May 01, 2025, 03:43 PM

Limited Time Offer

25%

Off

Get Premium 250-580 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jutta

7 months ago

Endpoint Activity Recorder is useful, but not for containment.

upvoted 0 times

...

Franchesca

7 months ago

File Deletion seems too drastic right away.

upvoted 0 times

...

Caitlin

8 months ago

I think Incident Manager would be more effective.

upvoted 0 times

...

Hollis

8 months ago

Surprised that Isolation is the go-to choice!

upvoted 0 times

...

Marcelle

8 months ago

Isolation is definitely the first step!

upvoted 0 times

...

Kanisha

8 months ago

I’m confused about whether to use Incident Manager or Isolation. I think I saw something similar in our last practice exam, but I can't recall the details.

upvoted 0 times

...

Cordelia

9 months ago

I feel like file deletion could be risky without confirming what files are malicious first. Isolation seems safer.

upvoted 0 times

...

Gilberto

9 months ago

I'm not entirely sure, but I remember practicing a question where we had to contain a threat quickly, and isolation was mentioned as a key feature.

upvoted 0 times

...

Leatha

9 months ago

I think isolation might be the right choice here, as it seems like the first step to prevent further damage.

upvoted 0 times

...

Twana

9 months ago

Ah, I think I've got it! The SEDR feature that would be used first to contain the threat is Isolation. That makes the most sense to me as the initial step to cut off the compromised endpoint and prevent further damage.

upvoted 0 times

...

Yuonne

9 months ago

I'm a bit unsure on this one. Is Isolation really the first step, or would something like File Deletion be used first to remove the malicious files? I'll have to think this through carefully.

upvoted 0 times

...

Elza

9 months ago

Okay, let me think this through. The question is asking about the SEDR feature that would be used first, so I'm guessing that means the most immediate response. Isolation seems like the right choice to quickly contain the threat.

upvoted 0 times

...

Ernest

10 months ago

Hmm, this looks like a tricky one. I'm thinking the SEDR feature that would be used first to contain the threat is Isolation, since that would cut off the compromised endpoint from the network and prevent further spread.

upvoted 0 times

...

Kasandra

1 year ago

Isolation is the name of the game! Contain that threat before it unleashes its inner Hulk.

upvoted 0 times

...

Johnathon

1 year ago

File Deletion? What is this, the dark ages? Let's be more proactive with Isolation.

upvoted 0 times

Aileen

1 year ago

Let's use Isolation to prevent the threat from spreading further.

upvoted 0 times

...

Ashleigh

1 year ago

Isolation is definitely more proactive than just deleting files.

upvoted 0 times

...

Reid

1 year ago

I agree, we need to isolate the compromised endpoint as soon as possible.

upvoted 0 times

...

Bonita

1 year ago

Isolation would be the best option to contain the threat.

upvoted 0 times

...

Pamella

1 year ago

I see your point, Elli. Incident Manager can also help in managing and tracking the incident.

upvoted 0 times

...

Elli

1 year ago

But wouldn't using the Incident Manager be more effective in this situation?

upvoted 0 times

...

My

1 year ago

I agree with Pamella, isolating the endpoint can help contain the threat.

upvoted 0 times

...

Pamella

1 year ago

I think the first step would be to isolate the compromised endpoint.

upvoted 0 times

...

Annita

1 year ago

Incident Manager? Nah, that's for the big boss. We need something more hands-on, like Isolation.

upvoted 0 times

...

Idella

1 year ago

Hmm, I'd say Endpoint Activity Recorder. Sounds like the perfect tool to gather intel on the incident.

upvoted 0 times

Odelia

1 year ago

Endpoint Activity Recorder could also help in gathering more information about the incident.

upvoted 0 times

...

Tesha

1 year ago

I agree, isolating the endpoint can prevent the threat from spreading.

upvoted 0 times

...

Hana

1 year ago

I think Isolation would be the best option to contain the threat.

upvoted 0 times

...

Edna

1 year ago

Isolation is the way to go! Gotta contain that threat before it spreads like wildfire.

upvoted 0 times

Whitney

1 year ago

Once the endpoint is isolated, we can investigate further to determine the extent of the compromise.

upvoted 0 times

...

Bobbye

1 year ago

I agree, isolating the endpoint is crucial to prevent further damage.

upvoted 0 times

...

Marvel

1 year ago

Using the Isolation feature first is crucial in situations like this.

upvoted 0 times

...

Benton

1 year ago

I agree, isolating the endpoint can prevent the threat from spreading further.

upvoted 0 times

...

Paris

1 year ago

Isolation is definitely the best option to contain the threat.

upvoted 0 times

...

Brande

1 year ago

Isolation is definitely the best option to contain the threat.

upvoted 0 times

...