During a recent investigation, analysts could not determine which processes ran on the compromised laptops or how the malware moved from one laptop to another. Which capability would MOST improve future investigations?
Select an answer to reveal the explanation.
Short Explanation
If you want to know what happened inside the house, a camera on the front gate won't tell you. Endpoint detection and response is the camera inside each room. The trap answers are good hygiene, but none of them records what actually ran.
Full Explanation
Endpoint detection and response tooling collects telemetry about activity on each device: which processes started and from where, which files were created or modified, and which network connections were made. That record lets investigators reconstruct execution chains and lateral movement between hosts, and it supports detection rules and rapid isolation of affected endpoints. A network intrusion detection sensor at the perimeter sees traffic crossing the internet boundary but has no view of process activity on laptops and typically misses movement between internal hosts. Weekly vulnerability scanning identifies weaknesses that may be exploited, which is valuable for prevention, but it records nothing about what an attacker actually did after compromise. Centralized patch management reduces the number of exploitable weaknesses, yet it provides no investigative evidence once an incident has occurred. Exam caveat: distinguish preventive controls, which reduce the likelihood of compromise, from detective and investigative capabilities, which explain what happened; the stem asks about investigation. Operational check: confirm that endpoint telemetry covers all managed laptops, is retained long enough for typical investigation timelines and is forwarded to the central monitoring platform.