What is the primary difference between an Endpoint Protection Platform and an Endpoint Detection and Response?

Question

Options

• AEPP focuses on prevention, and EDR focuses on advanced threats that evade perimeter
• BEDR focuses on prevention, and EPP focuses on advanced threats that evade perimeter
• CEPP focuses on network security, and EDR focuses on device security.
• DEDR focuses on network security, and EPP focuses on device security.

• A
  91% (29)
• C
  3% (1)
• D
  6% (2)

Explanation

EPP (Endpoint Protection Platform) is designed primarily for prevention - blocking known malware, viruses, and threats before they execute, using techniques like signature-based detection and application control. EDR (Endpoint Detection and Response) assumes some threats will slip past prevention and focuses on detecting, investigating, and responding to advanced threats that have already evaded perimeter defenses, using behavioral analysis and continuous monitoring.

Why the distractors are wrong:

• B reverses the roles - EDR is not the prevention tool, EPP is.
• C and D are both wrong because neither EPP nor EDR is a network security tool - both operate at the endpoint (device) level; the network vs. device framing is a fabricated distinction.

Memory tip: Think of EPP as the lock on the front door (keep threats out) and EDR as the security camera inside the house (detect and respond when something gets in anyway). "Prevention = EPP, Post-breach = EDR."

No community discussion yet for this question.