EDR can compare endpoint behavior with an established _____.
Answer
baseline
Explanation
### Why this is right
A baseline is the reference for expected or normal behavior. EDR can identify abnormal behavior by comparing endpoint activity with that reference.
### The concept
The baseline gives analysts and systems a point of comparison. If observed behavior differs, it may be worth investigating, especially if it also aligns with known indicators of attack. A deviation alone does not prove malicious activity because legitimate work can also vary.
### Terms
- **Baseline**: A reference for expected system behavior.
### Remember
Anomaly detection depends on knowing what usual behavior looks like.
Related Questions
- Which of the following is an example of an adversary attack activity, as opposed to a system vulnerability or a defensive measure? (Select all that apply.)(intermediate)
- Which information is most directly useful when coordinating technical response across teams?(basic)
- Attackers necessarily complete all life-cycle stages quickly, so extended monitoring is unnecessary.(basic)
- The foundational three-stage model of organizational change consisting of Unfreeze, Change, and Refreeze was introduced by social psychologist Kurt _____.(basic)
- Select ALL elements that belong in a documented cyber risk assessment.(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free