3.5 Configure Parsing Rules XDR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of testing a parsing rule against sample log data?

   • ATo verify that fields are extracted and mapped correctly
   • BTo check if the log source is sending data
   • CTo measure the storage cost of the parsed logs
   • DTo determine the optimal retention period for the logs
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A team is creating a parsing rule for a log source that uses a format like '2025-03-01 12:00:00,user=jdoe,action=login'. They need to extract the 'user' and 'action' fields. What are the components of the parsing rule that they need to configure?

   • AAlert severity, notification channel, and response action.
   • BLog source, storage location, and retention policy.
   • CData type, encryption key, and access control list.
   • DMatch conditions, extraction patterns, and field mappings.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is ingesting logs from a custom application that uses a mix of key-value pairs and JSON. Some logs are in the format 'event=login user=jdoe', while others are '{"event":"login","user":"jdoe"}'. They need to normalize the 'user' field for both formats. What is the most efficient approach?

   • ACreate two separate parsing rules, one for each format, and ensure they are ordered correctly.
   • BCreate a single regex pattern that can match both formats using alternation.
   • CUse the JSON parser for all logs and ignore the key-value format.
   • DPreprocess the logs to convert key-value pairs to JSON before ingestion.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When creating a new parsing rule in the XDR interface, which of the following must be specified first?

   • AThe severity level of alerts generated by the rule
   • BThe log source that the rule will parse
   • CThe retention period for the parsed data
   • DThe destination folder for parsed logs
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   An analyst is testing a parsing rule with a sample log and sees that the 'src_ip' field is extracted as '192.168.1.1' but the 'dst_ip' field is extracted as '10.0.0.2:8080'. The log line is 'src_ip=192.168.1.1 dst_ip=10.0.0.2:8080'. The regex is 'src_ip=(?<src_ip>\S+) dst_ip=(?<dst_ip>\S+)'. What is the most likely cause of the 'dst_ip' including the port?

   • AThe regex is missing a delimiter between the IP and port.
   • BThe '\S+' pattern matches the port because it is not whitespace.
   • CThe 'dst_ip' field is defined with a regex that includes the port.
   • DThe log line has a trailing space that causes the match to include the port.
   Reveal Solution Discussion Select an answer first