CS0-003 Question 87

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  I'm skeptical towards option B. I mean, will EDR still be effective after the fact? Shouldn't it already be present prior to the compromise? Any real world scenario input please?

• 1

  Option B is valid. That's what we usually do when there is an active compromise. There should already be an EDR on the first place.

• Chose BD5

  D. Use microsegmentation to restrict connectivity to/from the web and database servers. Microsegmentation involves dividing the network into smaller, isolated segments, and it can be a highly effective way to contain an adversary's movement within the network. By restricting connectivity between the web server and the database server to only the necessary communication paths, you can limit the attacker's ability to move laterally within the network. B. Deploy EDR on the web server and the database server to reduce the adversary’s capabilities. Endpoint Detection and Response (EDR) solutions are designed to monitor and respond to suspicious activities on endpoints (servers, workstations). By deploying EDR on both the web server and the database server, you can actively detect and respond to malicious activities, reducing the adversary's capabilities and potentially stopping their progress.