3.1 Use XQL to Query Datasets XDR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A junior analyst is writing an XQL query to find all firewall events where the destination port is 22 (SSH) and the action was 'allow'. The analyst wants to see the source IP, destination IP, and the time of the event. The analyst wrote the following query but it is returning a syntax error: 'dataset = firewall | filter action_dst_port = 22 and action = allow | fields src_ip, dst_ip, _time'. Which part of the query is causing the syntax error?

   • AThe '=' operator should be '==' for numeric comparison.
   • BThe field name 'dst_ip' is incorrect; it should be 'action_dst_ip'.
   • CThe filter clause is missing parentheses around the conditions.
   • DThe value 'allow' should be enclosed in single quotes.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which XQL command is used to select only specific fields to be included in the query results?

   • Afilter
   • Bfields
   • Climit
   • Dsort
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In XQL, which symbol is used to chain multiple commands in a single query?

   • A& (ampersand)
   • B> (greater than)
   • C| (pipe)
   • D; (semicolon)
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which XQL function is used to count the number of records in a dataset or group?

   • Amax()
   • Bavg()
   • Csum()
   • Dcount()
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security operations team is experiencing slow query performance when investigating incidents. The team has a query that scans the entire xdr_data dataset to find all events related to a specific file hash. The query is: 'dataset = xdr_data | filter action_file_hash = 'abc123' | fields agent_hostname, _time, action_file_name'. The team needs to improve the query's performance without changing the result set. Which modification would most effectively reduce the amount of data scanned?

   • AAdd a 'head 100' clause to the query to limit the number of returned records.
   • BAdd a 'fields' clause to the query to project only the necessary fields.
   • CAdd a filter for the agent_hostname, such as 'and agent_hostname = 'host-01''.
   • DAdd a time range filter to the query, such as 'and _time >= '2024-01-01T00:00:00Z''.
   Reveal Solution Discussion Select an answer first