What SEDR feature would be utilized first to contain the threat?

An Incident Responder has determined that an endpoint is compromised by a malicious threat.

What SEDR feature would be utilized first to contain the threat?
A . File Deletion
B . Incident Manager
C . Isolation
D . Endpoint Activity Recorder

View Answer

Answer: C

Explanation:

When an Incident Responder determines that an endpoint is compromised, the first action to contain the threat is to use the Isolation feature in Symantec Endpoint Detection and Response (SEDR). Isolation effectively disconnects the affected endpoint from the network, thereby preventing the malicious threat from communicating with other systems or spreading within the network environment. This feature enables the responder to contain the threat swiftly, allowing further investigation and remediation steps to be conducted without risk of lateral movement by the attacker.