A laptop shows signs of active compromise and may be spreading laterally. Responders need to cut it off from the rest of the network immediately while keeping it reachable from the security console so they can continue collecting evidence. Which EDR response action fits?
Select an answer to reveal the explanation.
Short Explanation
Isolation is like quarantining a patient in a room with a window: nobody else can catch it, but the doctors can still see what's going on. You stop the spread and keep collecting evidence. Wiping the laptop stops the spread too, but it throws away every clue you came for.
Full Explanation
Endpoint isolation is an EDR response action that places a host into a restricted network state from the console. The agent blocks the host's network traffic so it cannot reach other systems or exfiltrate data, while keeping the channel to the EDR service open so that responders can continue to collect telemetry, run queries and perform remediation. In Cisco Secure Endpoint, isolation maintains communication with the Secure Endpoint cloud for exactly this reason. That meets both requirements: containment now and continued investigation. Retrospective detection is a detection mechanism that applies a changed file disposition to hosts that already saw a file; it is not a containment action, and it does not reclassify a host. A remote wipe destroys the evidence that responders need and is an MDM action for lost devices rather than an incident-response containment step. A simple custom detection is a list of file hashes to treat as malicious; it does not block IP addresses or interact with a perimeter firewall. Exam caveat: isolation is not a substitute for root-cause analysis; the host should be remediated or reimaged before isolation is lifted. Operational check: start isolation, confirm that the host cannot reach an internal server, and verify that new telemetry from the host still appears in the console.