3.8 Explain the Use of Host Insights Information XDR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which action can an analyst perform using the host inventory in Host Insights?

   • ADeploy new software to all hosts in a specific group
   • BRemotely shut down a host that is compromised
   • CChange the firewall rules on a host
   • DFilter hosts by operating system or IP address
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How does Host Insights enrich an XDR investigation?

   • ABy generating a network topology map of the organization
   • BBy providing a list of all firewall rules in the environment
   • CBy providing detailed host context such as processes and users related to an alert
   • DBy automatically quarantining the host when an alert is triggered
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security administrator needs to identify all hosts that have not been seen in the last 30 days and may be decommissioned. Which Host Insights data should be used?

   • AHost Inventory, filtering by last seen date.
   • BProcess Activity, filtering by process execution time.
   • CUser Session, filtering by login time.
   • DVulnerability Assessment, filtering by scan date.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security analyst is prioritizing patching efforts. The analyst needs to identify hosts that have a high risk score due to multiple critical vulnerabilities and are also running a specific high-risk application. Which Host Insights data should the analyst use?

   • AHost Inventory and User Session data.
   • BXDR Alert Details and Host Inventory data.
   • CNetwork Activity and Process Activity data.
   • DVulnerability Assessment and Process Inventory data.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst is investigating an alert that originated from a host. The analyst needs to understand which user was logged on at the time of the alert and what applications were running. Which Host Insights data should the analyst review?

   • AThe User Session and Process Activity data for that host.
   • BThe Network Activity data for that host.
   • CThe Host Inventory and Vulnerability data for that host.
   • DThe XDR Alert Details page only.
   Reveal Solution Discussion Select an answer first