What activity does Endpoint Detection and Response (EDR) continuously record?

### Why this is right Endpoint Detection and Response (EDR) continuously records endpoint activity, including configuration changes, file modifications, and user account actions. The stored records can later be reviewed and analyzed. ### The concept EDR looks for endpoint changes associated with known indicators of attack or behavior that differs from a baseline. Its telemetry gives responders evidence about what changed on a device. EDR is distinct from NetFlow, which describes network traffic origin, destination, and volume, and from DLP, which focuses on sensitive-data handling. ### The other options - **B. Only the origin, destination, and amount of network traffic.** This describes NetFlow data, not endpoint telemetry. - **C. Only the full contents of every packet crossing the network.** This describes full packet capture, not EDR activity recording. - **D. Only the handling of sensitive data in email.** DLP can detect sensitive-data handling, but EDR records broader endpoint activity. ### Terms - **Telemetry**: Recorded observations about system activity. - **Endpoint**: A device or system whose activity is monitored. ### Remember EDR records what happens on endpoints; network capture records traffic between systems.