SkillTestPro | CCNP Security 350-701 SCOR Practice Test 24

CCNP Security 350-701 SCOR Practice Test 24 (Hard) - Endpoint Detection and Response (EDR) Concepts

CISCO CCNP Security Exam Logo

1 / 10

Which capability distinguishes an Endpoint Detection and Response (EDR) solution from traditional signature-only antivirus software?

EDR functions identically to traditional antivirus with no additional capability

EDR only scans files once per week with no continuous monitoring

EDR is only capable of detection with absolutely no response capability

Continuous behavioral monitoring, detailed telemetry collection, and investigative/response tooling, not just static signature matching

EDR relies exclusively on file hash comparison with no behavioral analysis

EDR requires no agent or software component on the endpoint at all

2 / 10

Which EDR concept refers to the detailed stream of endpoint activity data (process creation, file access, registry changes, network connections) continuously collected for later analysis?

802.1Q trunk negotiation frames

DHCP lease renewal timers

Spanning tree topology change notifications

Endpoint telemetry

OSPF hello packet exchange

BGP keepalive messages

3 / 10

Which EDR workflow step involves an analyst reviewing collected telemetry and contextual data to determine whether a flagged event represents an actual security incident or a benign false positive?

Physical hardware procurement

Alert triage and investigation

Office space allocation planning

Employee onboarding paperwork processing

Vendor contract renewal negotiation

Annual budget forecasting

4 / 10

Which EDR response action would allow an analyst to terminate a malicious process running on an endpoint directly from the management console, without needing physical access to the device?

Waiting for the user to manually open Task Manager themselves

Physically unplugging the device's power cable

Submitting a change request ticket to be reviewed the following quarter

Mailing a replacement device to the user

Remote process termination

Disabling the building's electrical circuit for that floor

5 / 10

Which EDR concept describes a low-confidence, ambiguous signal that on its own may not indicate compromise, but combined with other similar signals across an investigation may reveal malicious intent?

A printer toner-low notification

A routine software update notification

A guaranteed, unambiguous confirmation of compromise requiring no further analysis, but typically only once confirmed against a second, independent telemetry source

An indicator of compromise (IOC) or indicator of attack (IOA) requiring correlation

A scheduled backup completion notification

A hardware failure notification with no security relevance

6 / 10

Which EDR capability allows security teams to proactively search across the endpoint fleet for subtle signs of an intrusion that automated detection rules did not already flag?

Threat hunting

Routine hardware inventory counting

Annual compliance paperwork filing

Physical facility walkthroughs

Passive waiting for automated alerts only, with no proactive activity

Manual employee interviews with no telemetry review

7 / 10

Which metric would a SOC team track to evaluate how quickly analysts identify a genuine security incident after the first related telemetry event occurred?

Mean time to detect (MTTD)

Average cafeteria wait time during lunch

Total number of installed office printers

Average employee commute distance

Total corporate office square footage

Number of scheduled fire drills per year

8 / 10

Which EDR integration allows automatically enriching an endpoint alert with external threat intelligence context, such as whether a related file hash or IP has been seen in other known campaigns?

Threat intelligence feed integration/correlation

Integration with the corporate cafeteria ordering system

Integration with the company's payroll processing system

Integration with the conference room booking calendar

Integration with the office building's HVAC control system

Integration with the employee parking assignment system

9 / 10

Which EDR/SOAR concept describes automatically executing a predefined sequence of response actions (such as isolate host, kill process, notify analyst) when a high-confidence detection occurs, without requiring manual step-by-step execution?

A response that only occurs once per fiscal quarter regardless of detection timing

A response limited strictly to sending a single email with no further action

A response that requires disabling the EDR platform entirely before acting

A fully manual, unscripted response performed differently each time by whichever analyst is available

A response requiring physical travel to the data center before any action can be taken

Automated response playbook/orchestration

10 / 10

Which combination of EDR capabilities together provides the most effective detection-through-response lifecycle for a SOC handling a suspected endpoint compromise?

Manual physical device inspection alone with no telemetry or remote response capability

Telemetry collection alone with no detection correlation, triage tools, or response actions

Automated response actions alone with no telemetry collection or triage capability

A single annual antivirus signature update with no continuous monitoring or response tooling, a distinction that becomes more relevant as the endpoint fleet continues to grow, though this varies depending on the specific endpoint operating system and version

Continuous telemetry collection, correlated detection with threat intelligence enrichment, analyst triage/threat hunting tools, and remote response actions such as isolation and process termination

Threat intelligence enrichment alone with no telemetry collection or response actions

Your score is

The average score is 0%