4.1 Define Key Syntax of CrowdStrike Query Language (CQL) CCFH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which logical operator in CQL is used to return events that satisfy at least one of multiple conditions?

   • ANOT
   • BOR
   • CAND
   • DXOR
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How do you search for a literal asterisk (*) character in a CQL field value?

   • ABy using the escape character before it: \*
   • BBy using a double asterisk: **
   • CBy enclosing it in quotes: "*"
   • DBy using the 'literal' keyword
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In CQL, what is the purpose of the 'AND' keyword when used between two field-value pairs?

   • AIt negates the second condition.
   • BIt specifies that either condition must be true.
   • CIt groups the conditions into a single field.
   • DIt specifies that both conditions must be true.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In CQL, what is the purpose of using parentheses in a query?

   • ATo group conditions and control precedence
   • BTo escape special characters
   • CTo specify a time range
   • DTo denote field names
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How do you specify an absolute time range in CQL?

   • AUsing the 'from' and 'to' keywords
   • BUsing the 'at' keyword
   • CUsing the 'between' keyword
   • DUsing a specific date and time format
   Reveal Solution Discussion Select an answer first