ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Endpoint detection and response (EDR) platforms install lightweight agents on each host that continuously monitor system behavior, use analytics to spot malicious activity (including fileless techniques), can automatically contain or kill suspicious processes, and forward rich telemetry to centralized consoles or SIEMs for investigation. A network-based IDS focuses on traffic, not host behavior, and cannot isolate local processes. Signature-only antivirus lacks the behavioral analytics needed to detect fileless threats and generally cannot quarantine running processes autonomously. A secure web gateway helps control web traffic but offers no host-level visibility or response capability, leaving endpoints exposed once malware is executed.