An organization deploys an EDR solution across all endpoints. What critical EDR capability allows the security team to remotely investigate a potentially compromised endpoint without physically touching the machine?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need live response because it lets you remotely enumerate processes, pull files, collect memory artifacts, and run commands on a potentially compromised endpoint from a console. That's the EDR capability that supports hands-off investigation during active incident response.
Full Explanation
The live response capability allowing collection of memory, process listings, files, and network connections from a remote console is correct because live response, sometimes called remote shell or live investigation, is a core EDR capability. It allows analysts to remotely enumerate processes, pull files, collect memory artifacts, and run commands on an endpoint during active incident response. Automated patch deployment to push security updates is wrong because patch deployment is a patch management function, not a distinctive EDR investigation capability. Full disk encryption management through the EDR console is wrong because disk encryption management is a separate security function typically handled by MDM or dedicated encryption tools. Software inventory tracking for license compliance is wrong because software inventory is an asset management function, not an EDR investigation capability.