Exam SY0-601 topic 1 question 540 discussion

Endpoint Detection and Response (EDR) * Monitor every application action and block malicious actions * Perform a root cause analysis * Isolate a system from the rest of the network * Delete something to roll back to a previously good configuration * The above can be completed by API. A. EDR

Endpoint Detection and Response (EDR) is a solution that provides continuous monitoring, analysis, and response capabilities on endpoints (devices) in an organization's network. Unlike traditional antivirus solutions that rely on known-bad signatures, EDR solutions use behavior-based analysis and heuristics to detect and respond to potential threats. EDR tools collect and analyze endpoint data in real-time, allowing security teams to identify suspicious activities, detect anomalous behavior, and respond to security incidents. They can detect and block various types of threats, including malware, ransomware, zero-day exploits, and fileless attacks, without solely relying on known signatures.

A. EDR is correct. Using EDR you can look for IoCs and run root cause analysis.