Study. uk . com
  1. Home
  2. All questions
  3. Question 519

CompTIA Security+ study material · question 519 of 611

Which two capabilities does endpoint detection and response give an incident responder? Choose two.

  1. A record of process, file and network activity on the host
  2. Recovery of the host from backup
  3. Automatic patching of the affected software
  4. The ability to isolate the host from the network
Show the answer

Answer: A. A record of process, file and network activity on the host
D. The ability to isolate the host from the network

The telemetry is the evidence and the isolation is the containment lever, which is why the two are packaged together.

Challenge yourself on this topic → Study as cards