CompTIA CySA+ CS0-003 Practice Question

In this scenario, initiating an on-demand threat hunt to gather more information is a knee-jerk action that does not immediately contain the potential threat. A threat hunt is a proactive, in-depth investigation and should be done after immediate containment. A memory dump may provide useful forensic data but could result in loss of volatile data if done incorrectly and does not contain the threat. Escalation to a cyber incident response team is a necessary step but not the most immediate action to take using EDR capabilities. Isolating the endpoint from the network mitigates the immediate risk of the threat spreading or exfiltrating data without needing to wait for full confirmation of the threat's nature. This quick isolation is a strength of EDR platforms and should be the analyst's priority.