20. A company's antivirus solution is effective in blocking malware but often has false positives. The security team has spent a significant amount of time on investigations but cannot determine a root cause. The company is looking for a heuristic solution. Which of the following should replace the antivirus solution?
Answer: B
EDR should replace the antivirus solution.
To address the challenges faced by the company, implementing an Endpoint Detection and Response (EDR) solution would be the most appropriate choice. EDR systems are designed to provide advanced threat detection and response capabilities, particularly in environments where traditional antivirus solutions may fall short due to false positives.
A) SIEM
A Security Information and Event Management (SIEM) system focuses on collecting and analyzing security event data from across an organization’s infrastructure. While it is valuable for monitoring and compliance, it does not directly replace the functionality of an antivirus solution in terms of real-time threat detection and response, making it less suitable for the company's immediate needs.
B) EDR
Endpoint Detection and Response (EDR) is specifically designed to address the limitations of traditional antivirus solutions. It provides continuous monitoring and data collection from endpoints, allowing for more sophisticated analysis of threats, including the ability to respond to incidents in real time. This makes EDR the ideal replacement for an antivirus solution in this scenario.
C) DLP
Data Loss Prevention (DLP) solutions are primarily aimed at preventing sensitive data from being accessed or transmitted outside the organization. While DLP is critical for data security, it does not directly address malware detection and response, which is the core issue faced by the company.
D) IDS
An Intrusion Detection System (IDS) monitors network traffic for suspicious activity and potential threats. However, it generally lacks the proactive response capabilities of EDR solutions and may not provide the comprehensive endpoint protection needed to effectively replace an antivirus system.
Conclusion
EDR is the most suitable replacement for the antivirus solution as it addresses both the detection of advanced threats and the management of false positives effectively. Other options, such as SIEM, DLP, and IDS, do not fulfill the specific needs for real-time threat response and analysis required by the company, making EDR the clear choice for enhancing their security posture.