3.8 Explain the Use of Host Insights Information XDR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An organization has a mix of endpoints with the Cortex XDR agent installed and some without. The security team wants to use Host Insights to get a complete view of all endpoints. What should they do?

   • AUse the Vulnerability Assessment to scan endpoints without the agent.
   • BUse the Host Inventory to manually add endpoints without the agent.
   • CUse the XDR Query Builder to collect data from endpoints without the agent.
   • DInstall the Cortex XDR agent on all endpoints to ensure data collection.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What user-related context does Host Insights provide to enhance an investigation?

   • AThe user's social media profile and activity
   • BThe user's physical location via GPS
   • CThe username and domain of the user logged into the host
   • DThe user's email content and attachments
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How does Host Insights primarily collect data from endpoints?

   • ABy reading the endpoint's event logs from a central SIEM
   • BBy querying the endpoint's BIOS and firmware directly over the network
   • CBy analyzing NetFlow data from the network switch
   • DBy installing an agent on each endpoint that gathers telemetry
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst needs to identify all endpoints in the environment that are running an outdated version of a specific application and are missing critical security patches. The analyst wants to use Host Insights to accomplish this. Which approach should the analyst take?

   • AUse the Process Activity page to find hosts running the application and then check patch status from the process details.
   • BUse the Vulnerability Assessment page to list all vulnerabilities and then cross-reference with application versions.
   • CUse the Host Inventory page to filter hosts by application version and patch status.
   • DUse the XDR Query Builder to search for hosts running the application and then manually check each host's patch status.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An analyst is investigating an alert that indicates a host is running a known vulnerable version of a software. The analyst needs to determine if the vulnerability is actively being exploited by checking if the vulnerable process is running and if there are any associated network connections. Which combination of Host Insights data should the analyst use?

   • AUser Session and Process Activity data for the host.
   • BHost Inventory and Vulnerability Assessment data for the host.
   • CXDR Alert Details and Host Inventory data for the host.
   • DProcess Activity and Network Activity data for the host.
   Reveal Solution Discussion Select an answer first