4.5 - Enterprise security tools (EDR, IPS, MDM)
Security+ SY0-701 objective 4.5 covers enterprise capabilities that enforce security. Endpoint detection and response (EDR) watches process behaviour; when it sees a process spawn PowerShell, disable logging, then encrypt files, the right response is to kill the process and isolate the host. The key difference between an IPS and an IDS is action: an IPS blocks a matched attack in-line before it reaches the server, while an IDS only alerts. Mobile device management can perform a selective (container) wipe that erases only corporate data from a lost BYOD phone, leaving personal data intact. You should also know firewalls, web and DNS filtering, email security, DLP and network access control. Expect scenario questions that describe a threat and ask which tool or response - EDR action, IPS versus IDS, or selective wipe - is correct.
Process spawns PowerShell + encrypts files = EDR: kill process, isolate host. IPS blocks in-line; IDS only alerts. Erase corporate data only on lost BYOD = selective (container) wipe.
Practice questions
1. What is the key difference between an IDS and an IPS?
- An IDS encrypts all network traffic
- IPS blocks in-line; IDS alerts (correct answer)
- An IDS hands out IP addresses
- The two are functionally identical
An IDS detects and alerts (passive, out-of-band). An IPS sits in-line and can actively drop/block malicious traffic. Both use signatures/anomaly detection.
2. Which set of records helps prevent email spoofing of your domain?
- A and AAAA records
- SPF, DKIM and DMARC (correct answer)
- MX records only
- CNAME records
SPF authorizes sending servers, DKIM signs messages, and DMARC ties them together with a policy/report — together they reduce spoofing/phishing.
3. Which endpoint tool detects, investigates and responds to threats on hosts with rich telemetry?
- A network DHCP server
- Endpoint Detection and Response (correct answer)
- A basic signature antivirus
- A patch-deployment server
EDR continuously monitors endpoints, records telemetry, detects behavior-based threats and enables investigation/response. XDR extends this across network, email, cloud.
4. Which secure protocol and port replace Telnet for encrypted remote command-line administration?
- FTP on port 21
- HTTP on port 80
- SSH on port 22 (correct answer)
- SNMP on port 161
SSH (TCP 22) encrypts remote CLI sessions, replacing cleartext Telnet (23). It also underpins SFTP and SCP for secure file transfer.
5. Blocking access to known-malicious domains at name resolution is called:
- Port forwarding
- DNS filtering (correct answer)
- MAC filtering
- Bandwidth shaping
DNS filtering blocks resolution of malicious/unwanted domains, stopping connections to phishing, malware C2 and known-bad sites early in the request.
6. Which control forces devices to meet health/policy checks before joining the corporate network?
- Network address translation
- Network access control (NAC) (correct answer)
- A reverse proxy at the edge
- A round-robin load balancer
NAC checks device posture (patch level, AV, config) and identity before granting network access, quarantining or remediating non-compliant devices.