Incident responders learn that a laptop was compromised about two weeks ago. They need to reconstruct which processes ran, which files were created and which network connections the host made since then. Which endpoint capability makes this possible?
Select an answer to reveal the explanation.
Short Explanation
You can't rewind a security camera that was never recording. EDR is the recorder: it keeps a running history of processes, files and connections so you can play back what happened two weeks ago. Plain antivirus only tells you about the files it judged, not the story around them.
Full Explanation
Endpoint detection and response agents continuously capture telemetry about process execution, parent-child relationships, file creation and modification, and network connections, and they retain that history centrally. Responders can then search and replay activity for a specific host over a past window, which is how they reconstruct an intrusion that began before anyone noticed it. In Cisco Secure Endpoint, device trajectory presents this history for a single computer. EPP on-access scanning evaluates files when they are written or executed and records detections; it is not designed to keep a complete record of benign process activity and connections. MDM inventory reports describe device configuration, enrollment and installed applications, not a timeline of processes and network sessions. Host firewall logs, where enabled, record allowed or blocked connections; they do not record process creation or file writes. Exam caveat: retention is finite, so the window that can be reconstructed depends on how long the product keeps telemetry, and an endpoint that was offline may upload its events later. Operational check: open the host's trajectory or event history, filter to the suspected start date, and trace the first suspicious process to its parent and any outbound connections.