An analyst is reviewing network traffic logs and needs to create a report that shows the destination IP, destination port, and the total number of bytes sent for each connection. The analyst wants to exclude connections to private IP addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Which XQL query should the analyst use?

dataset = firewall | filter not action_dst_ip in ('10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16') | fields action_dst_ip, action_dst_port, action_bytes_sent | comp sum(action_bytes_sent) as total_bytes by action_dst_ip, action_dst_port | sort desc total_bytes

dataset = firewall | filter action_dst_ip != '10.0.0.0/8' and action_dst_ip != '172.16.0.0/12' and action_dst_ip != '192.168.0.0/16' | fields action_dst_ip, action_dst_port, action_bytes_sent | comp sum(action_bytes_sent) as total_bytes by action_dst_ip, action_dst_port | sort desc total_bytes

dataset = firewall | filter action_dst_ip not in ('10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16') | fields action_dst_ip, action_dst_port, action_bytes_sent | comp sum(action_bytes_sent) as total_bytes by action_dst_ip, action_dst_port | sort desc total_bytes

dataset = firewall | filter action_dst_ip in ('10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16') | fields action_dst_ip, action_dst_port, action_bytes_sent | comp sum(action_bytes_sent) as total_bytes by action_dst_ip, action_dst_port | sort desc total_bytes

In the XQL query editor, which syntax correctly restricts results to events that occurred within the last 30 minutes relative to the current time?

dataset = xdr_data | where _time > 30 minutes ago

dataset = xdr_data | filter _time >= now() - 30 minutes

filter _time >= date_add(now(), -30, 'minute')

Palo Alto NetworksCertified XDR Analyst

Domain 3Objective 1

3.1 Use XQL to Query Datasets XDR-ANALYST Practice Questions (Page 4)

Part of the Data Analysis domain, which accounts for 28% of the XDR-ANALYST exam.

19questions here

4free pages

10concepts

28%of the exam

Questions 16–19

16application · medium
An analyst is reviewing network traffic logs and needs to create a report that shows the destination IP, destination port, and the total number of bytes sent for each connection. The analyst wants to exclude connections to private IP addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Which XQL query should the analyst use?
Select an answer first
17foundation · medium
In the XQL query editor, which syntax correctly restricts results to events that occurred within the last 30 minutes relative to the current time?
Select an answer first
18foundation · easy
Which XQL logical operator is used to combine two conditions where BOTH must be true for a record to be included?
Select an answer first
19foundation · easy
Which XQL command is used to restrict the number of records returned by a query?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to XDR-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XDR-ANALYST” is a trademark of its owner, used for identification only.

3.1 Use XQL to Query Datasets XDR-ANALYST Practice Questions (Page 4)

Questions 16–19

In the XQL query editor, which syntax correctly restricts results to events that occurred within the last 30 minutes relative to the current time?

Which XQL logical operator is used to combine two conditions where BOTH must be true for a record to be included?

Which XQL command is used to restrict the number of records returned by a query?

Keep studying — Data Analysis