EDR can identify endpoint behavior that differs from an established baseline.
Answer
true
Explanation
### Why this is right
EDR is designed to identify changes aligned with known attack indicators or abnormal behavior compared with an established baseline. A baseline represents the reference for expected behavior.
### The concept
A behavior is easier to assess when the organization has a reference for what is usual. EDR can compare observed endpoint activity with that baseline and raise a possible event when it differs. A difference is a reason for review, not conclusive proof of an attack.
### The other options
- **False**: This would deny a stated EDR detection approach: comparison with established baselines.
### Terms
- **Baseline**: A reference description of expected or usual behavior.
### Remember
A deviation from a baseline signals a need to assess, not automatic proof of compromise.
Related Questions
- Which of the following is an example of an adversary attack activity, as opposed to a system vulnerability or a defensive measure? (Select all that apply.)(intermediate)
- Which information is most directly useful when coordinating technical response across teams?(basic)
- Attackers necessarily complete all life-cycle stages quickly, so extended monitoring is unnecessary.(basic)
- The foundational three-stage model of organizational change consisting of Unfreeze, Change, and Refreeze was introduced by social psychologist Kurt _____.(basic)
- Select ALL elements that belong in a documented cyber risk assessment.(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free