3.4 Use Lookup Tables XDR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A team is creating a lookup table to track which users have been assigned a security awareness training. The table will have a field for the username and a field for the completion date. What is the most appropriate data type for the completion date field?

   • AInteger, to store the date as a number like 20231005.
   • BBoolean, to store whether the training was completed.
   • CString, to store the date in a readable format like '2023-10-05'.
   • DTimestamp, to store the date and time in a standard format.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When a lookup table entry becomes outdated (e.g., an IP address is no longer malicious), what is the appropriate management action?

   • ARestart the XDR service to refresh the table
   • BCreate a new lookup table for every change
   • CIgnore the outdated entry because it will not affect queries
   • DDelete or update the specific entry in the table
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization maintains a lookup table mapping employee usernames to their department and manager. An analyst is investigating a series of suspicious login events and wants to include the department and manager for each username in the query results to better understand the affected business units. How should the analyst incorporate the lookup table into the investigation?

   • AUse a lookup operation in the query to join the login event data with the employee lookup table on the username field.
   • BExport the login events to a spreadsheet and manually merge the employee data.
   • CModify the login event log source to include department and manager fields.
   • DCreate a new query that only searches the lookup table for the usernames in the login events.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which data type is most appropriate for a field that will store IPv4 addresses in a lookup table?

   • ABoolean
   • BInteger
   • CString
   • DIP
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is asked to provide a list of all internal IP addresses that have communicated with a known malicious external IP. The analyst has a lookup table that maps internal IPs to asset names. What is the benefit of using the lookup table in this investigation?

   • AIt will speed up the query by reducing the amount of log data to search.
   • BIt will allow the analyst to see the asset names associated with the internal IPs in the results.
   • CIt will replace the need to search the raw logs for the malicious IP.
   • DIt will automatically block the malicious IP from further communication.
   Reveal Solution Discussion Select an answer first