A security manager is updating the endpoint protection standard and must explain to the executive committee how endpoint detection and response (EDR) differs from traditional signature-based anti-malware. Which statement BEST captures that difference?
- AEDR replaces the need for any baseline anti-malware engine because behavioural analytics alone catches all known and unknown threats.
- BEDR continuously records endpoint telemetry and applies behavioural analytics so analysts can detect, investigate, and respond to threats that evade signature matching. Correct
- CEDR is primarily a compliance reporting tool that aggregates anti-malware alerts from endpoints into a central console for auditors.
- DEDR scans files on access using a regularly updated signature database and quarantines any binary whose hash matches a known malicious sample.
Why A is wrong: This overstates EDR capability and uses an absolute claim; in practice EDR is layered with anti-malware and other controls, and assuming complete coverage is the kind of overconfidence the CBK warns against.
Why B is correct: This captures the three pillars the CBK attributes to EDR: continuous telemetry collection, behavioural detection beyond signatures, and supported response and investigation workflows, which is why it is the BEST executive description.
Why C is wrong: Centralised reporting is a feature of many endpoint suites but it is not what defines EDR; a candidate focused on management reporting rather than detection mechanics may be drawn to this.
Why D is wrong: That description fits traditional signature-based anti-malware, which is the very control EDR is being contrasted with, so it cannot be the differentiator.