3.3 Identify and Explain Data Query Options XDR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An analyst wants to search for all firewall traffic events from a specific source IP. Which pre-defined query builder template would be most appropriate to start with?

   • AUser Authentication
   • BThreat Intelligence
   • CFirewall Traffic
   • DEndpoint Malware
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst needs to investigate a potential data exfiltration incident. The analyst wants to use a pre-defined query builder template that is designed for this type of investigation. What is the first step the analyst should take?

   • ASelect the appropriate pre-defined query builder template from the template list
   • BSchedule the query to run immediately
   • CExport the query results to a file
   • DSave the query to the Query Library
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is investigating a brute-force attack. The analyst wants to use a pre-defined query builder template to quickly identify the source IP addresses. What is the main advantage of using the template over writing a query from scratch?

   • AIt saves the query to the Query Library automatically
   • BIt reduces the time and effort needed to construct the query
   • CIt generates a report without any customization
   • DIt automatically schedules the query to run every hour
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security operations center (SOC) wants to automatically generate a report of all failed login attempts every hour. The report should be stored for later review. Which feature should be used to accomplish this?

   • AManually run the query every hour
   • BUse the pre-defined query builder template
   • CSave the query to the Query Library
   • DSchedule Query to run the query every hour
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst has created a complex query that identifies lateral movement patterns. The analyst wants to share this query with other team members so they can run it on demand. Which action should the analyst take?

   • ASchedule the query to run every hour
   • BSave the query to the Query Library
   • CExport the query results to a PDF
   • DUse the pre-defined query builder template
   Reveal Solution Discussion Select an answer first