3.4 Use Lookup Tables XDR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A junior analyst is new to XDR and asks a senior analyst why the team uses lookup tables instead of just adding extra fields to the raw logs. The senior analyst needs to explain the primary benefit of using lookup tables for data enrichment. What is the best explanation?

   • ALookup tables allow for the enrichment of events at query time without modifying the original log data.
   • BLookup tables automatically generate alerts for any matching event.
   • CLookup tables increase the storage capacity of the XDR platform.
   • DLookup tables are the only way to filter events in an XDR query.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a key difference between static and dynamic data when populating a lookup table?

   • AStatic data is fixed and does not change frequently, while dynamic data is updated from external sources or automated processes
   • BStatic data is used for filtering, while dynamic data is used for enrichment
   • CStatic data is stored in the cloud, while dynamic data is stored on-premises
   • DStatic data is manually entered, while dynamic data is always generated by AI
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization needs to create a lookup table of all domain names used by their corporate web applications. The list is maintained by the web team in a shared spreadsheet. The security team wants to use this data in XDR to enrich web proxy logs. What is the best way to get this data into a lookup table?

   • AHave the web team add the domains directly to the XDR platform.
   • BCreate a query that reads the spreadsheet directly from the shared drive.
   • CAsk the web team to export the spreadsheet as a CSV file and then import it into a new lookup table.
   • DManually type the domain names into the lookup table based on the spreadsheet.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An analyst is investigating a series of failed login attempts. They have a lookup table with usernames and their associated risk scores. The analyst wants to see the risk score for each failed login event. However, some usernames in the login logs are not present in the lookup table. What should the analyst do to ensure the query results are complete?

   • AManually add the missing usernames to the lookup table with a default risk score.
   • BUse an inner join so that only login events with a matching username in the lookup table are returned.
   • CRun two separate queries: one for matched usernames and one for unmatched usernames.
   • DUse a left join so that all login events are returned, with a null risk score for unmatched usernames.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In a join between events and a lookup table, what is the typical matching criterion?

   • AThe severity of the event
   • BThe timestamp of the event
   • CThe size of the event data
   • DA common field value, such as an IP address or username
   Reveal Solution Discussion Select an answer first