What Is a Feature of an Endpoint Detection and Response Solution?

Describe Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) solutions

What is a feature of an endpoint detection and response solution?

ensuring the security of network devices by choosing which devices are allowed to reach the network
capturing and clarifying data on email, endpoints, and servers to mitigate threats
rapidly and consistently observing and examining data to mitigate threats Correct Answer
preventing attacks by identifying harmful events with machine learning and conduct-based defense

Answer Correct answer: C — An EDR solution rapidly and consistently observes and examines endpoint data to detect, investigate, and mitigate threats.

Community Insight

This question tests the EPP-versus-EDR boundary, and the trap is choosing the machine-learning prevention wording in D because it sounds advanced while actually describing EPP-style defense.

Endpoint detection and response (EDR) is defined by continuous endpoint visibility, investigation, and response rather than prevention alone. The page establishes that the best fit is rapid, consistent observation and examination of endpoint data (C), not the EPP-style prevention in D.

The most common error is choosing D because it mentions machine learning and conduct-based defense; however, that option emphasizes prevention, which is the hallmark of EPP, while EDR centers on observation, examination, and response to threats that are already present.

Community Discussion (10 comments)

XBfoundX 👍 1 Selected: C

Is C: Effective anti-malware protection is the most demanding of these capabilities, because malware can appear harmless at first and change behavior later. To counter that, a modern EPP uses advanced anti-malware techniques: Machine learning: Uses large-scale data to determine whether a file is malicious, including files it has not seen before. And here is specified: ndpoint detection and response (EDR) focuses on threats that have already evaded front-line defenses and entered the environment, continuously monitoring endpoints to find, investigate, and contain them.

b8os5h 👍 1 Selected: C

Behavioral analysis using a sandbox (Threat Grid) is included in the functionality of EPP, not EDR, as in Q525. Question #525 What is offered by an EPP solution but not an EDR solution? C. sandboxing

Redou2201 👍 2 Selected: C

we need to be clear, the question here is about EDR, not AMP AMP is the fusion of both tools EDR + EPP, the answer D is more covered by EPP and the answer C more by EDR

Redou2201 👍 2 Selected: C

I am going with C on this question, because in D the therm of "prevention" is more covored by EPP than by the EDR .

madboy2 👍 2 Selected: C

Its Answer C, Answer D is more covered by a EPP

Premium_Pils 👍 4 Selected: D

EDR leverages machine learning capabilities. (AMP, which is Ciscos'EDR. uses the threat intelligence of cisco talos.) "In addition to continuous file analysis, it is important to note that EDR is only as good at detecting files as the threat intelligence that powers it. This intelligence leverages large-scale data, machine learning capabilities, and advanced file analysis to help detect threats." https://www.cisco.com/c/en/us/products/security/endpoint-security/what-is-endpoint-detection-response-edr-medr.html#~edr-capabilities

Premium_Pils 👍 1

AMP with Talos: Built-in Talos Threat Hunting https://www.cisco.com/site/us/en/products/security/endpoint-security/secure-endpoint/index.html

NullNull88 👍 2 Selected: D

preventing attacks by identifying harmful events with machine learning and conduct-based defense

luismg 👍 2 Selected: C

AMP does not perform machine learning on the device, the answer is C

devildog 👍 3

securitytut says this is D.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

C captures EDR's defining workflow: rapidly and consistently observing and examining endpoint telemetry so security teams can detect, investigate, and mitigate threats. Cisco positions EDR around continuous monitoring, data collection, and response rather than simply blocking an attack at the perimeter. The wording "observing and examining" maps to EDR's visibility and investigation functions, while "mitigate threats" covers containment and remediation. Therefore C is the EDR-specific feature in this list.

Why the Other Options Are Wrong

A describes network access control or network admission, such as deciding which devices may reach the network, not endpoint detection and response. B mixes email, endpoint, and server data into a broad data-capture statement; it is not the precise EDR capability Cisco tests here and drifts toward SIEM or broader analytics. D is the main distractor because it mentions machine learning and conduct-based defense, but its emphasis on "preventing attacks" belongs to endpoint protection platforms (EPP) and endpoint anti-malware. EDR may use ML internally, yet the exam separates prevention-focused EPP from detection, investigation, and response-focused EDR.

Community Comment Notes

Community opinion is split, with several learners selecting C because they view prevention as an EPP responsibility; Redou2201 and madboy2 both argued that option D's prevention wording belongs more to EPP than to EDR. Premium_Pils supported D by citing Cisco Talos threat intelligence and machine learning, which shows why the distractor is attractive, but the presence of ML in a product does not make prevention the defining EDR feature. luismg also challenged the on-device machine-learning interpretation and chose C, reinforcing the EPP/EDR distinction. The split is a useful reminder to anchor on Cisco's exam doctrine rather than the vote count.

Official Reference

https://www.cisco.com/site/us/en/products/security/endpoint-security/secure-endpoint/index.html

Exam Strategy

When a question asks for an EDR feature, eliminate options whose leading verb is "preventing" or whose focus is network admission; look for continuous monitoring, investigation, and response language. Remember that EPP blocks and EDR observes, investigates, and remediates, even when products combine both.

Frequently Asked Questions

Why is option D not the best description of an EDR feature?

Option D emphasizes preventing attacks through machine learning and conduct-based defense, which is closer to EPP and anti-malware. EDR focuses on continuous observation, investigation, and response to threats on endpoints.

Does Cisco Secure Endpoint combine EPP and EDR capabilities?

Yes, Cisco Secure Endpoint bundles prevention and EDR functions, but the exam still expects you to separate prevention-focused EPP from observation-and-response-focused EDR when asked for a defining feature.

More 350-701 FAQ →

Related Analysis

← Back to 350-701 Study Guide