3.1 Use XQL to Query Datasets XDR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An analyst wants to display only the 'hostname', 'user', and 'action' fields from the xdr_data dataset. Which query accomplishes this?

   • Adataset = xdr_data | select hostname, user, action
   • Bdataset = xdr_data | filter hostname, user, action
   • Cdataset = xdr_data | project hostname, user, action
   • Ddataset = xdr_data | fields hostname, user, action
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   An analyst needs to investigate a suspicious file execution on a Windows endpoint. Which dataset should be queried first?

   • Axdr_data
   • Bauth_data
   • Ccloud_data
   • Dfirewall_data
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which XQL command is used to order query results by a specific field?

   • Aorder
   • Brank
   • Carrange
   • Dsort
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which practice is most effective for optimizing an XQL query's performance?

   • AUsing the fields command before filtering
   • BSorting results before applying filters
   • CSelecting all fields and filtering at the end
   • DApplying filters early in the query to reduce the data scanned
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which XQL function would be used to convert a field value to uppercase?

   • Astrtoupper()
   • Bupper()
   • Ccapitalize()
   • Dtoupper()
   Reveal Solution Discussion Select an answer first