MENU
Which EDR feature is used to search for real-time indicators of compromise?
Suggested Answer: B
Get Premium 250-586 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
In Endpoint Detection and Response (EDR), the Endpoint search feature is used to search for real-time indicators of compromise (IoCs) across managed devices. This feature allows security teams to investigate suspicious activities by querying endpoints directly for evidence of threats, helping to detect and respond to potential compromises swiftly.
SES Complete Documentation describes Endpoint search as a crucial tool for threat hunting within EDR, enabling real-time investigation and response to security incidents.
34 comments · newest first
JO
Jospeh
11 months ago
Really? I always thought Device Group search was the best for that.
AL
Alyce
11 months ago
I thought Domain search was more for tracking websites, not real-time.
LA
Lasandra
11 months ago
Wait, is Cloud Database search not an option? Seems off.
BE
Bettyann
12 months ago
Agreed, Endpoint search is the go-to for that!
VA
Vashti
12 months ago
I think it's definitely Endpoint search.
MA
Marjory
12 months ago
I feel like Device Group search was mentioned in a similar practice question, but I’m confused about its application.
TH
Theodora
1 year ago
Domain search sounds familiar, but I can't recall if it specifically relates to indicators of compromise.
FE
Felicia
1 year ago
I remember something about Cloud Database search being used for historical data, not real-time.
SA
Samira
1 year ago
I think the answer might be Endpoint search, but I’m not entirely sure. We practiced that in class.
SA
Sanjuana
1 year ago
I'm a little confused by the options here. Cloud Database search and Domain search don't seem quite right for this type of question. I'm leaning towards Endpoint search, but I'll double-check my notes to be sure.
CH
Chandra
1 year ago
The key here is that we're looking for real-time indicators, so I think the Endpoint search feature is the best option. That's where we can monitor the endpoints for any suspicious activity in real-time.
EM
Emile
1 year ago
Hmm, I'm a bit unsure about this one. I know EDR is for endpoint detection and response, but I'm not sure which specific feature is used to search for indicators. I'll have to think this through carefully.
SH
Sharmaine
1 year ago
I'm pretty sure the answer is Endpoint search, since that's where we'd look for real-time indicators of compromise on the endpoints.
WI
Winfred
2 years ago
I'm not sure, but I think Cloud Database search could also be a possibility.
HE
Helene
2 years ago
I agree with Dorinda, Endpoint search makes sense for real-time indicators.
DO
Dorinda
2 years ago
I think the answer is B) Endpoint search.
AR
Artie
2 years ago
Haha, this question is a real 'compromise' on our intelligence! Endpoint search is the clear winner.
NA
Natalya
2 years ago
Cloud Database search? Seriously? I prefer my data grounded, not floating in the clouds.
MA
Marguerita
2 years ago
Device Group search? Sounds like a glorified version of 'Find My iPhone'.
DE
Dean
2 years ago
Domain search? What is this, a scavenger hunt?
MI
Miss
2 years ago
D) Device Group search
TO
Tonette
2 years ago
C) Domain search
DE
Deeanna
2 years ago
B) Endpoint search
GE
Gerald
2 years ago
A) Cloud Database search
BE
Bettye
2 years ago
Endpoint search is the way to go! Real-time IOCs, baby!
DA
Daron
2 years ago
Endpoint search is the way to go! Real-time IOCs, baby!
NO
Noel
2 years ago
D) Device Group search
MI
Minna
2 years ago
Device group search could also be a good option for real-time IOC detection.
JU
Justine
2 years ago
C) Domain search
KA
Kaitlyn
2 years ago
I think domain search might be helpful too in detecting IOCs.
DI
Diego
2 years ago
Cloud database search could also be useful for finding indicators of compromise.
KA
Karan
2 years ago
B) Endpoint search
CA
Carlton
2 years ago
I agree, endpoint search is the best for real-time IOCs.
CO
Corazon
2 years ago
A) Cloud Database search