thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Host Isolation

Disconnecting an endpoint from the network except for the security management channel to contain a threat.

Definition

EDR and XDR platforms can network-isolate a host with one click, blocking all traffic except communication to the management console so analysts can continue investigating. It preserves volatile evidence better than powering off. Isolation is a key containment action.

Example

Isolating a host showing ransomware behavior while collecting memory through the EDR agent.

Exam tip

Isolate rather than power off to preserve volatile memory evidence.

Related terms