4.2 Build a Query and Perform a Search Using CQL CCFH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   After running a CQL search, an analyst notices that the results include events from multiple event types, even though they only expected one. The query was: `EventType='ProcessRollup2' OR EventType='ProcessRollup2'`. What is the most likely reason for the unexpected results?

   • AThe query is correct, and the results are accurate.
   • BThe field name 'EventType' is case-sensitive and should be 'eventtype'.
   • CThe OR operator is causing the query to return all events.
   • DThe analyst may have forgotten to clear a previous filter or the search is using a saved view with additional filters.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which CQL query correctly searches for events where the event type is 'ProcessRollup2' and the user name is 'admin'?

   • Aevent_type=ProcessRollup2, user_name=admin
   • Bevent_type == 'ProcessRollup2' && user_name == 'admin'
   • Cevent_type=ProcessRollup2 AND user_name=admin
   • Devent_type:ProcessRollup2 user_name:admin
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   After executing a CQL search in the Falcon platform, where does the hunter typically view the returned events?

   • AIn the Event Search results table
   • BIn the Host management console
   • CIn the Falcon dashboard widgets
   • DIn the Detection details page
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst runs a query and receives a 'Syntax Error' message. The query is: `EventType='ProcessRollup2' AND UserName='admin'`. What is the most likely cause of the syntax error?

   • AThe field name 'UserName' is incorrect.
   • BThe query is missing a closing parenthesis.
   • CThere is a hidden character or extra space in the query.
   • DThe single quotes around the values are incorrect.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst is looking for events where a specific file was created. They know the file name is 'malware.exe' and the event type is 'FileCreateInfo'. Which query will correctly find these events?

   • AEventType='FileCreateInfo' AND FileName='malware.exe'
   • BFileCreateInfo='malware.exe'
   • CEventType='FileCreateInfo' OR FileName='malware.exe'
   • DFileName='malware.exe'
   Reveal Solution Discussion Select an answer first