CAS-005 · Question #14
During a security assessment using an EDR solution, a security engineer generates the following report about the assets in the system: After five days, the EDR console reports a blocked infection on…
The correct answer is D. 0W1N29 spreads the malware through other hosts in the network. The key clue is the “Enabled (bypass)” status on 0WIN29. That means the EDR agent was running but being bypassed, effectively allowing malicious code to execute unchecked. An attacker could exploit that bypass to install the RAT on 0WIN29, and then attempt lateral movement to…
Question
During a security assessment using an EDR solution, a security engineer generates the following report about the assets in the system:
After five days, the EDR console reports a blocked infection on the host 0WIN23 by a remote access Trojan. Which of the following most likely enabled the attempted infection?
Exhibits
Options
- A0W1N23 uses a legacy version of Windows that is not supported by the EDR
- BLN002 was not supported by the EDR solution and propagates the RAT
- CThe EDR has an unknown vulnerability that was exploited by the attacker
- D0W1N29 spreads the malware through other hosts in the network
How the community answered
(28 responses)- A25% (7)
- B11% (3)
- C7% (2)
- D57% (16)
Explanation
The key clue is the “Enabled (bypass)” status on 0WIN29. That means the EDR agent was running but being bypassed, effectively allowing malicious code to execute unchecked. An attacker could exploit that bypass to install the RAT on 0WIN29, and then attempt lateral movement to 0WIN23. 0WIN23’s EDR then detected and blocked the inbound infection, but the initial foothold was enabled by the vulnerability in the 0WIN29 deployment.
Community Discussion
No community discussion yet for this question.