3.8 Explain the Use of Host Insights Information XDR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How does Host Insights help correlate host activity with user sessions?

   • ABy analyzing the user's typing patterns to identify them
   • BBy storing the user's passwords for authentication
   • CBy tracking login and logout events and associating them with processes
   • DBy monitoring the user's webcam feed
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is investigating a potential data exfiltration incident. The analyst suspects that a specific application is being used to transfer data. Which Host Insights data would help confirm which hosts are running that application and which users are logged on?

   • AProcess Inventory and User Session data.
   • BXDR Alert Details and Host Inventory data.
   • CHost Inventory and Vulnerability data.
   • DNetwork Activity and Process Activity data.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What type of information does Host Insights provide about applications and processes on a host?

   • AThe list of running processes and their associated command lines
   • BThe source code of each running application
   • CThe license key of each installed application
   • DThe network bandwidth consumed by each application
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An analyst is investigating a potential insider threat. The analyst suspects that a user is running a specific application that is not approved. The analyst needs to determine which hosts the user has logged on to and if the application is running on those hosts. Which Host Insights data should the analyst use?

   • AUser Session and Process Inventory data.
   • BHost Inventory and Vulnerability data.
   • CXDR Alert Details and Host Inventory data.
   • DNetwork Activity and Process Activity data.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During an XDR investigation, an analyst notices a suspicious process on a host. The analyst needs to determine if this process is unique to that host or if it is running on multiple hosts in the environment. Which Host Insights capability should the analyst use?

   • AUse the XDR Query Builder to search for the process in the raw event logs.
   • BUse the Process Inventory to search for the process name and view all hosts running it.
   • CUse the User Session page to see which users are associated with the process.
   • DUse the Host Details page to view the process list for the specific host.
   Reveal Solution Discussion Select an answer first