4.1 Define Key Syntax of CrowdStrike Query Language (CQL) CCFH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a valid relative time range in CQL?

   • Asince 24h
   • B24h ago
   • Clast 24h
   • Dlast 24 hours
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In CQL, what does the wildcard character '*' represent when used in a field value?

   • AIt matches exactly one character.
   • BIt matches any single character.
   • CIt escapes the next character.
   • DIt matches zero or more characters.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a complete CQL query that searches for events with the field 'event_simpleName' equal to 'ProcessRollup2' in the last 24 hours?

   • Aevent_simpleName = ProcessRollup2 last 24h
   • Bevent_simpleName = ProcessRollup2 | tail(24h)
   • Cevent_simpleName = ProcessRollup2 AND last 24 hours
   • Devent_simpleName = ProcessRollup2 | time last 24h
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which CQL operator would you use to find events where a numeric field is greater than a specific value?

   • A!=
   • B<
   • C=
   • D>
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the correct order of components in a CQL query when searching for events?

   • ASearch terms, then time range, then filters
   • BSearch terms, then filters, then time range
   • CTime range, then search terms, then filters
   • DFilters, then time range, then search terms
   Reveal Solution Discussion Select an answer first