Discuss Broadcom 250-580 Exam Topic 2 Question 14

An Incident Responder has determined that an endpoint is compromised by a malicious threat. What SEDR feature would be utilized first to contain the threat?

AFile Deletion

BIncident Manager

CIsolation

DEndpoint Activity Recorder

Suggested Answer: C

When an Incident Responder determines that an endpoint is compromised, the first action to contain the threat is to use the Isolation feature in Symantec Endpoint Detection and Response (SEDR). Isolation effectively disconnects the affected endpoint from the network, thereby preventing the malicious threat from communicating with other systems or spreading within the network environment. This feature enables the responder to contain the threat swiftly, allowing further investigation and remediation steps to be conducted without risk of lateral movement by the attacker.

Get Premium 250-580 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

35 comments · newest first

Jutta 10 months ago

Endpoint Activity Recorder is useful, but not for containment.

Franchesca 10 months ago

File Deletion seems too drastic right away.

Caitlin 11 months ago

I think Incident Manager would be more effective.

Hollis 11 months ago

Surprised that Isolation is the go-to choice!

Marcelle 11 months ago

Isolation is definitely the first step!

Kanisha 11 months ago

I’m confused about whether to use Incident Manager or Isolation. I think I saw something similar in our last practice exam, but I can't recall the details.

Cordelia 12 months ago

I feel like file deletion could be risky without confirming what files are malicious first. Isolation seems safer.

Gilberto 12 months ago

I'm not entirely sure, but I remember practicing a question where we had to contain a threat quickly, and isolation was mentioned as a key feature.

Leatha 12 months ago

I think isolation might be the right choice here, as it seems like the first step to prevent further damage.

Twana 1 year ago

Ah, I think I've got it! The SEDR feature that would be used first to contain the threat is Isolation. That makes the most sense to me as the initial step to cut off the compromised endpoint and prevent further damage.

Yuonne 1 year ago

I'm a bit unsure on this one. Is Isolation really the first step, or would something like File Deletion be used first to remove the malicious files? I'll have to think this through carefully.

Elza 1 year ago

Okay, let me think this through. The question is asking about the SEDR feature that would be used first, so I'm guessing that means the most immediate response. Isolation seems like the right choice to quickly contain the threat.

Ernest 1 year ago

Hmm, this looks like a tricky one. I'm thinking the SEDR feature that would be used first to contain the threat is Isolation, since that would cut off the compromised endpoint from the network and prevent further spread.

Kasandra 1 year ago

Isolation is the name of the game! Contain that threat before it unleashes its inner Hulk.

Johnathon 1 year ago

File Deletion? What is this, the dark ages? Let's be more proactive with Isolation.

Aileen 1 year ago

↳ replying to Johnathon

Let's use Isolation to prevent the threat from spreading further.

Ashleigh 1 year ago

↳ replying to Johnathon

Isolation is definitely more proactive than just deleting files.

Reid 1 year ago

↳ replying to Johnathon

I agree, we need to isolate the compromised endpoint as soon as possible.

Bonita 1 year ago

↳ replying to Johnathon

Isolation would be the best option to contain the threat.

Pamella 1 year ago

I see your point, Elli. Incident Manager can also help in managing and tracking the incident.

Elli 1 year ago

But wouldn't using the Incident Manager be more effective in this situation?

My 1 year ago

I agree with Pamella, isolating the endpoint can help contain the threat.

Pamella 1 year ago

I think the first step would be to isolate the compromised endpoint.

Annita 1 year ago

Incident Manager? Nah, that's for the big boss. We need something more hands-on, like Isolation.

Idella 1 year ago

Hmm, I'd say Endpoint Activity Recorder. Sounds like the perfect tool to gather intel on the incident.

Odelia 1 year ago

↳ replying to Idella

Endpoint Activity Recorder could also help in gathering more information about the incident.

Tesha 1 year ago

↳ replying to Idella

I agree, isolating the endpoint can prevent the threat from spreading.

Hana 1 year ago

↳ replying to Idella

I think Isolation would be the best option to contain the threat.

Edna 1 year ago

Isolation is the way to go! Gotta contain that threat before it spreads like wildfire.

Whitney 1 year ago

↳ replying to Edna

Once the endpoint is isolated, we can investigate further to determine the extent of the compromise.

Bobbye 1 year ago

↳ replying to Edna

I agree, isolating the endpoint is crucial to prevent further damage.

Marvel 1 year ago

↳ replying to Edna

Using the Isolation feature first is crucial in situations like this.

Benton 1 year ago

↳ replying to Edna

I agree, isolating the endpoint can prevent the threat from spreading further.

Paris 1 year ago

↳ replying to Edna

Isolation is definitely the best option to contain the threat.

Brande 1 year ago

↳ replying to Edna

Isolation is definitely the best option to contain the threat.

Broadcom 250-580 Exam - Topic 2 Question 14 Discussion