Exam CAS-004 topic 1 question 78 discussion

I think that a UTM appliance is the best solution

Yea, get an EDR solution.

EDR - "The goal is to prevent further endpoint disruption."

I hate this question because of how they can trick you throwing in the last sentence: "The edge network is protected by a web proxy." I was thinking in my head why would it be an antivirus solution and leaning towards answer: C. But the key to cracking this problem was looking at it and seeing the goal in the stated question was to prevent further endpoint disruption due to new malware. An End Point Detection Response goes beyond the traditional AV by providing RT monitoring, behavioral analysis and ability to detect and respond to advanced threats including zero-day malware and fileless attacks.

Advanced Threat Detection: EDR solutions offer more advanced capabilities than traditional antivirus software. They can detect and respond to a wider range of threats, including new and unknown malware. Real-Time Monitoring: EDR provides real-time monitoring and analysis of endpoint activities, allowing for quicker detection and response to threats. Behavioral Analysis: EDR tools use behavioral analysis to identify suspicious activities, which can help in detecting malware that might not be caught by signature-based methods. Incident Response: EDR solutions often include tools for incident response, helping to contain and remediate threats more effectively.

"service outages", "further endpoint disruption". Endpoints can refer to servers.

EDR is superior to a UTM because that means there is a post-breach endpoint security platform that is hosted in the cloud. Perfect for "at home" Source: Verifying each answer against Chat GPT, my experience, other test banks, a written book, and weighing in the discussion from all users to create a 100% accurate guide for myself before I take the exam. (It isn't easy because of the time needed, but it is doing my diligence)

"Working from home" indicates that it needs EDR

(EDR) is a proactive endpoint security approach designed to supplement existing defenses. This advanced endpoint approach shifts security from a reactive threat approach to one that can detect and prevent threats before they reach the organization

https://www.malwarebytes.com/cybersecurity/business/what-is-edr