Exam objective 6.2 of the 350-701 exam focuses on endpoint security technologies. This section solves the problem of keeping every device on your network safe from malware, ransomware, and advanced attacks that slip past traditional defences. Understanding antivirus, anti-malware, and EDR is not optional—these are the tools you will configure, manage, and troubleshoot as a security professional.
Jump to a section
A simple way to picture Endpoint Security Technologies
When you first move into a new house, you install a lock on the front door to keep strangers out. That lock is your first line of defence, but it does not stop someone from sneaking in through an open window or picking the lock. So you add a security camera at the front door, and a smart alarm that detects broken glass. This combination of tools works together to protect your home: the lock blocks entry, the camera watches for suspicious activity, and the alarm immediately alerts you to a break-in.
Now apply this to your computer. The lock is your antivirus software: it checks every file that tries to enter your system against a list of known villains (malware signatures). The security camera is anti-malware software: it watches for unusual behaviour, like a program suddenly trying to delete all your files, even if that program does not match any known villain. The smart alarm is Endpoint Detection and Response (EDR): it continuously monitors every corner of your computer, detects a threat in real time, and sends an alert to a security team (or even automatically stops the attack).
Just as you would not rely solely on a door lock for home security, a modern computer cannot rely only on antivirus. Threats evolve, and so must your defences. This is why endpoint security technologies layer antivirus, anti-malware, and EDR together to protect every device that connects to a network.
Let us start with the most basic question: what is an endpoint? An endpoint is any device that connects to a network. This includes laptops, desktop computers, smartphones, tablets, servers, and even Internet of Things (IoT) devices like smart cameras or printers. In the context of the 350-701 exam, endpoint security refers to the technologies used to protect these devices from malicious software (malware) and unauthorised access.
Malware is a broad term for any software intentionally designed to cause damage, steal data, or disrupt normal computer operations. Common types include viruses (self-replicating code that attaches to files), worms (self-replicating code that spreads across networks without needing a host file), ransomware (malware that encrypts your files and demands payment for the decryption key), trojans (malware disguised as legitimate software), and spyware (software that secretly monitors your activity).
Antivirus software is the oldest and most well-known endpoint security technology. It works by maintaining a database of known malware signatures. A signature is a unique digital fingerprint of a piece of malware, like a hash or a specific sequence of code. When you download a file or run a program, the antivirus scans it and compares it to its signature database. If a match is found, the antivirus blocks the file or quarantines it. This method is effective against known threats but fails against new or modified malware that has no known signature. This is why antivirus is often described as signature-based detection.
Anti-malware software is a broader category that includes antivirus capabilities but adds more advanced detection methods. It uses heuristic analysis to examine the behaviour of a program. For example, if a program tries to modify system files or encrypt large numbers of files, anti-malware can flag that behaviour as suspicious even if it has never seen that exact program before. Anti-malware also often uses behavioural monitoring to watch how software interacts with the operating system in real time. This allows it to catch zero-day exploits—attacks that take advantage of a vulnerability unknown to the software vendor. Anti-malware is more proactive than antivirus because it does not rely solely on a pre-existing list of known threats.
Endpoint Detection and Response (EDR) is the most advanced of these three technologies. EDR software continuously monitors endpoint activity and collects data about processes, network connections, file changes, registry modifications, and user behaviour. It uses machine learning and threat intelligence to identify patterns that indicate an attack. When a potential threat is detected, EDR can automatically respond by isolating the compromised device from the network, killing malicious processes, or rolling back changes made by the malware. EDR also provides forensic analysis tools that allow security analysts to investigate the entire chain of events that led to the incident—this is known as the kill chain. The kill chain maps the stages of an attack, from initial reconnaissance to data exfiltration.
Why do we need all three? Because threats are constantly evolving. A new ransomware strain might not be detected by signature-based antivirus, but anti-malware might catch its encrypting behaviour. However, if the ransomware uses legitimate system tools (a technique called living-off-the-land), even behaviour-based detection might miss it until EDR correlates the activity across multiple endpoints and identifies the attack pattern.
Modern endpoint security often combines these technologies into a single platform called Extended Detection and Response (XDR), which integrates data from endpoints, networks, cloud workloads, and email. For the 350-701 exam, you need to understand the distinctions between antivirus, anti-malware, and EDR, as well as how they complement each other in a layered defence strategy (also known as defence in depth).
Another key concept is the difference between host-based and network-based protection. Antivirus, anti-malware, and EDR agents are installed directly on the endpoint—this is host-based. Network-based protections like firewalls and intrusion detection systems (IDS) operate separately on the network itself. For the exam, understand that endpoint security technologies are host-based and protect the individual device, even when it is offline or disconnected from the corporate network.
Installation of Endpoint Agent
The endpoint security software is installed on each device. This agent handles all scanning, monitoring, and communication with a central management server. Without this step, no protection exists on the device.
Signature Update and Initial Scan
The antivirus component downloads the latest signature database from the vendor's cloud. It then performs a full scan of the endpoint's files to identify any known malware already present. This establishes a clean baseline.
Continuous Behavioural Monitoring
The anti-malware and EDR components begin real-time monitoring of process creation, file access, network connections, and registry changes. This allows detection of anomalous behaviour that could indicate an attack.
Threat Detection and Alert Generation
When a suspicious event occurs (e.g., a program attempting to encrypt many files), the EDR correlates the activity with threat intelligence and generates an alert. The alert includes context such as the user, process, and timeline.
Automated Response and Containment
Based on configured policies, the EDR may automatically isolate the endpoint from the network, terminate malicious processes, or revert changes. This step contains the threat before it spreads to other devices.
Forensic Investigation and Remediation
Security analysts use the EDR console to replay the attack sequence, understand the root cause (e.g., a phishing email), and ensure the endpoint is clean. They then apply patches, reset credentials, and update policies to prevent recurrence.
Imagine you work as a junior security analyst at a medium-sized company called 'TechRetail'. The company has 500 employees, each using a company-issued laptop running Windows. Your job is to ensure these laptops are protected against malware and other threats.
Your first task is to deploy endpoint security software. You install a commercial suite that includes antivirus, anti-malware, and EDR capabilities. You configure the antivirus component to update its signature database every hour from the vendor's cloud. You enable heuristic analysis in the anti-malware module to catch suspicious behaviour. You turn on the EDR module to collect endpoint telemetry and send it to a centralised security information and event management (SIEM) platform.
One Tuesday morning, a user in the finance department reports that her laptop is running slowly and her files have been renamed with a '.locked' extension. You receive an alert from the EDR system: it has detected an unusual number of file encryption operations on that endpoint. The EDR automatically isolates the laptop from the network, preventing the ransomware from spreading to file shares or other devices. You then use the EDR's forensic tools to replay the events. You see that the user opened a PDF email attachment two minutes before the encryption started. The PDF had a malicious macro that downloaded a payload. The antivirus did not catch it because the payload was a new variant, but the anti-malware heuristic flagged the macro execution as suspicious. The EDR then correlated the macro activity with the sudden spike in file writes and generated the alert.
Your next step is to remediate. You use the EDR console to roll back the encrypted files to their previous versions (a feature of some EDR solutions). You reset the user's password and revoke any active sessions. You then write a report for your manager detailing the incident, the timeline, and the technologies that detected and responded to it.
In a real-world scenario, you would also:
Update the antivirus signature database across all endpoints to include the new ransomware variant.
Review the email security rules to block similar attachments.
Run a scan on all other endpoints to ensure no one else received a similar email.
Conduct a phishing awareness training session for the finance team.
This example shows that antivirus alone would have failed. Anti-malware might have blocked the macro, but if it was configured too permissively, it could have allowed the download. EDR provided the critical detection and automated response that stopped the attack from spreading and gave you the evidence needed for forensic analysis.
The 350-701 exam tests your understanding of endpoint security technologies in several ways. First, you must know the definitions and primary functions of antivirus, anti-malware, and EDR. Expect multiple-choice questions that ask you to identify which technology is best suited for a given scenario. For example: 'Which technology uses behavioural analysis to detect previously unknown malware?' The correct answer is anti-malware (or if the question specifies advanced behavioural analysis and response, EDR).
Second, the exam tests your understanding of signature-based versus behaviour-based detection. You need to know that antivirus relies on signatures, anti-malware uses heuristics and behavioural analysis, and EDR uses both plus continuous monitoring and automated response. A common trap question will describe a scenario where a signature-based scanner fails to detect a new variant, and ask what technology would have caught it—the answer is anti-malware or EDR.
Third, the exam covers the concept of endpoint isolation. EDR can automatically isolate a compromised endpoint from the network to prevent lateral movement. You should understand that this is a feature of EDR, not of traditional antivirus. Another trap: a question might ask what to do when an endpoint is sending suspicious traffic—the best answer often involves isolating the endpoint and then investigating with EDR forensics.
Fourth, you need to know the difference between host-based and network-based security. Antivirus, anti-malware, and EDR are host-based (installed on the endpoint). Network-based protections like firewalls, IDS, and IPS operate at the network layer. Questions may ask you to categorise a given technology.
Key concepts to memorise for the exam:
Antivirus: signature-based, known threats, file scanning
Anti-malware: heuristic analysis, behavioural monitoring, zero-day threats
EDR: continuous monitoring, automated response, forensic analysis, kill chain, endpoint isolation
Defence in depth: layering multiple security technologies
XDR: integration of endpoint, network, email, and cloud data
The kill chain: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, actions on objectives
Exam trap: a question might describe a 'new strain of ransomware that encrypts files and spreads via email'. The answer might involve anti-malware catching the macro behaviour, but the question asks for the technology that 'provides the most comprehensive analysis and response'—that is EDR. Do not assume that antivirus is the answer just because it is the most familiar.
Another trap: the term 'endpoint detection and response' might be confused with 'network detection and response' (NDR). Read the question carefully—if it mentions data from the host, it is EDR. If it mentions network traffic, it is NDR.
Finally, you should know that modern endpoint solutions often integrate with cloud-based threat intelligence feeds. The exam might ask what source EDR uses to correlate data—the answer is threat intelligence and machine learning.
Antivirus uses signature-based detection to block known malware by comparing files against a database of known threat fingerprints.
Anti-malware adds heuristic and behavioural analysis to detect unknown or zero-day threats based on suspicious actions.
Endpoint Detection and Response (EDR) continuously monitors endpoint activity, provides automated response, and enables forensic investigation of incidents.
A defence-in-depth strategy layers antivirus, anti-malware, and EDR so that one technology's weakness is covered by another's strength.
EDR can isolate a compromised endpoint from the network automatically, preventing lateral movement and containing the attack.
The kill chain describes the stages of an attack, and EDR tools help analysts trace an incident back through each stage for complete forensic understanding.
These come up on the exam all the time. Here's how to tell them apart.
Antivirus
Relies on signature-based detection of known threats
Scans files and compares them to a database of known malware fingerprints
Ineffective against new or modified malware with no known signature
Anti-Malware
Uses heuristic analysis and behavioural monitoring to detect unknown threats
Analyses how a program behaves in real time
Can catch zero-day exploits and polymorphic malware that changes its code
Anti-Malware
Focuses on detecting and blocking malicious software
May include automated blocking but lacks deep forensic capabilities
Typically does not provide continuous monitoring of all endpoint activity
Endpoint Detection and Response (EDR)
Provides continuous monitoring and logging of all endpoint events
Includes automated response like isolation and process termination
Offers forensic investigation tools to trace the entire kill chain
Host-Based Security
Installed directly on the endpoint device
Protects the device even when offline or disconnected from the network
Examples include antivirus, anti-malware, and EDR agents
Network-Based Security
Operates on network devices like firewalls and intrusion prevention systems
Can only protect devices while they are connected to the network
Examples include firewalls, IDS, and IPS
Mistake
Antivirus and anti-malware are the same thing and can be used interchangeably.
Correct
Antivirus is a subset of anti-malware. Antivirus focuses on signature-based detection of known malware, while anti-malware includes heuristic and behavioural analysis to catch unknown threats.
Many vendors market their products as both, blurring the line. Beginners often think both terms mean the same thing because they see them used together.
Mistake
EDR only detects threats but does not take any action to stop them.
Correct
EDR includes automated response capabilities, such as isolating endpoints, killing processes, and rolling back changes. Detection alone is not sufficient for EDR classification.
The 'Response' part of EDR is sometimes overlooked. Beginners focus on the 'Detection' aspect and assume it is just a more advanced monitoring tool.
Mistake
If you have an EDR solution, you do not need antivirus or anti-malware.
Correct
EDR complements antivirus and anti-malware. They work in layers: antivirus handles known threats, anti-malware catches suspicious behaviour, and EDR provides deep monitoring and response. Removing the other layers weakens security.
People assume that the most advanced tool replaces all simpler ones, not realising that defence in depth relies on overlapping protections.
Mistake
Antivirus software can protect against all types of malware, including ransomware, because it scans files.
Correct
Antivirus is effective only against malware with known signatures. New ransomware variants can bypass signature-based detection. Anti-malware behavioural analysis and EDR monitoring are needed to detect such attacks.
Antivirus has been the standard for decades, so beginners overestimate its capability. They do not realise that threats constantly evolve and signatures are always behind the latest attacks.
Mistake
Endpoint security only matters for Windows computers. Mac and Linux systems do not need it.
Correct
All endpoints, regardless of operating system, are targets. Mac and Linux systems are increasingly targeted by malware. Endpoint security technologies are platform-agnostic and should be deployed on all devices.
The historical dominance of Windows malware leads beginners to assume other systems are immune. They do not consider that attackers follow the user base, and both Mac and Linux use in enterprise environments have grown.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Windows Defender is a built-in antivirus solution, but it may not be sufficient for enterprise environments. A dedicated endpoint security suite with anti-malware and EDR provides deeper protection, centralised management, and advanced threat intelligence.
EDR focuses solely on endpoint devices (laptops, servers). XDR extends that visibility to include network traffic, email, and cloud workloads, correlating data across multiple security layers for a more complete picture.
Yes, EDR uses behavioural analysis and machine learning to detect unusual patterns of activity, which allows it to identify zero-day exploits even though no signature exists for the specific vulnerability.
It can cause performance issues and conflicts, as both may attempt to scan or quarantine files simultaneously. Most organisations use a single-vendor security suite or follow vendor compatibility guidelines.
The endpoint is blocked from communicating with other devices on the network while maintaining a connection to the EDR management console for investigation. This prevents the malware from spreading but still allows remote remediation.
The kill chain helps security analysts understand the stages of an attack so they can implement appropriate controls at each phase. EDR tools map events to the kill chain, making it easier to prioritise investigations and responses.
You've finished Endpoint Security Technologies. Continue through the 350-701 study guide to build a complete picture of the exam.
Done with this chapter?