Which of the following is a type of endpoint telemetry collected directly from a host by an Endpoint Detection and Response (EDR) agent? (Select all that apply.)

### Why this is right - **Configuration changes.** EDR records changes to endpoint configuration. - **File modifications.** Changes to files are among the named endpoint activities. - **User account actions.** EDR records activity involving user accounts. ### The concept Endpoint telemetry is a record of activity on monitored systems. These records support later review and analysis, and can be kept in a dedicated database or aggregated with other security data. Approval status for external data transfers is not one of the endpoint activity examples given in the material. ### The other options - **The approval status of every external data transfer.** This is not listed as an EDR telemetry example; DLP policies may address external data transfers. ### Terms - **Telemetry**: Data that records observations about system behavior. ### Remember Remember the three named examples: configuration, files, and user-account activity.