Exam CAS-004 topic 1 question 298 discussion

ChatGPT 4 suggests - C. EDR (Endpoint Detection and Response) EDR solutions are designed to continuously monitor and collect data from endpoints to provide security teams with the visibility they need to identify, investigate, and respond to threats. Unlike traditional antivirus solutions that primarily focus on preventing known malware threats, EDR solutions offer comprehensive visibility into endpoint activities, including when assets are off the corporate network. EDR capabilities often include behavioral analysis to detect suspicious activities that may indicate a compromise, real-time monitoring, and the ability to remotely respond to incidents. This makes EDR an effective solution for mitigating risks associated with endpoints operating outside the corporate network.

EDR solutions may not provide the same level of visibility for endpoints that are off-network or not connected via a VPN. UEBA solutions, on the other hand, are designed to analyze user and entity behavior across a wider range of data sources, including cloud-based activities and off-network behavior. They are better suited to addressing the specific challenge of visibility into off-network or remote activities. While EDR can play a role in endpoint security, it may not provide the same coverage for scenarios where assets are off-network, making UEBA a more appropriate choice for mitigating the specific risk described in the question.

Holy typos, Batman.