XSIAM-Analyst Data Analysis With XQL Practice Test 2 — 15 Questions

Question 1

An analyst wants to calculate the time difference between two events (process creation and network connection) for the same process GUID. Which XQL function calculates the time delta?

Accepted Answer

alter time_diff = timestamp_diff(end_time, start_time). Subtracting timestamps or using duration calculation functions in event correlation is handled via timestamp arithmetic or delta functions.

Answer

alter time_diff = end_time - start_time

Answer

alter time_diff = elapsed(start_time, end_time)

Answer

alter time_diff = datetime_diff(end_time, start_time)

Question 2

When working with JSON-formatted log data stored inside a text field in XQL, how can an analyst access a specific nested key named 'user_id'?

Accepted Answer

alter extracted_id = json_extract_scalar(raw_json_field, "$.user_id"). XQL supports dot notation or json extraction functions like json_extract() to query nested JSON structures.

Answer

alter extracted_id = read_json(raw_json_field, 'user_id')

Answer

parse raw_json_field json to user_id

Answer

alter extracted_id = raw_json_field.user_id

Question 3

An analyst needs to transform an IP address field into an integer representation within an XQL query using the 'alter' command. Which function should be used?

Accepted Answer

alter ip_int = ip_to_int(source_ip). XQL provides the dedicated 'ip_to_int()' function to convert an IP address string into its integer representation, which is useful for range comparisons and arithmetic on IP addresses. The correct syntax within an 'alter' command is 'alter ip_int = ip_to_int(source_ip)'. This function handles both IPv4 and IPv6 formats and returns the numeric equivalent.

Answer

alter ip_int = cast(source_ip as integer)

Answer

alter ip_int = to_integer(source_ip)

Answer

alter ip_int = parse_ip(source_ip, 'int')

Question 4

Which THREE commands are valid XQL pipeline stages used for data transformation and shaping? (Choose three)

Accepted Answer

fields. Option A, `fields`, is a valid XQL pipeline stage that selects, orders, or drops columns in the result set, making it a core data-shaping stage. Option D, `alter`, is a valid XQL stage that creates or modifies fields in the pipeline, so it directly performs data transformation. Option E, `rename`, is a valid XQL stage that renames fields in the output, which is another standard shaping operation. The unmarked options do not belong because `transform` (B) and `modify` (C) are not XQL pipeline stage keywords; XQL uses stages such as `fields`, `alter`, `rename`, `filter`, `comp`, and `dedup` rather than those generic terms.

Answer

transform

Answer

modify

Question 5

Which THREE aggregate functions can be used with the 'stats' command in XQL to analyze numerical metrics? (Choose three)

Accepted Answer

count(). Valid stats aggregate functions include count, sum, and max.

Answer

highest()

Answer

total()

Question 6

When joining two datasets in XQL, which THREE join types are supported by the XQL join command? (Choose three)

Accepted Answer

inner. XQL supports inner, outer (or left outer), and right joins or similar relational join types in its syntax.

Answer

outer

Answer

recursive

Answer

cross

Question 7

An analyst wants to ensure that string comparisons in an XQL filter are case-insensitive. Which TWO methods or operators can achieve this? (Choose two)

Accepted Answer

Use regex matching operators with case-insensitive flags or appropriate syntax.. XQL supports case-insensitive operators (like ~= or specific modifiers) and string conversion functions like lower().

Answer

Use the case_insensitive=true parameter inside the filter command.

Answer

Use the exact match operator '===' which ignores case by default.

Answer

Append the suffix [ci] to the equals operator.

Answer

Convert fields to lowercase using lower() prior to comparison.

Question 8

An analyst is investigating authentication logs and needs to filter events based on multiple status codes (e.g., 401, 403, 500). Which TWO valid XQL filter constructions can accomplish this? (Choose two)

Accepted Answer

filter status_code = 401 OR status_code = 403 OR status_code = 500. Option D is correct because XQL supports chaining boolean comparisons with OR, so 'filter status_code = 401 OR status_code = 403 OR status_code = 500' explicitly evaluates each status code and returns events matching any of the three values. Option E is correct because XQL supports the IN operator, and 'filter status_code IN (401, 403, 500)' is the idiomatic way to test a field against a set of discrete values in a single expression. Option A is not valid because CONTAINS ANY is not a supported XQL filter construction for matching a field against a list of values. Option B is not valid because MATCHES in XQL expects a regular expression string (e.g., MATCHES "401|403|500"), not a bracketed alternation list. Option C is not valid because the equality operator == compares a field to a single scalar value and cannot take a parenthesized list of values.

Answer

filter status_code CONTAINS ANY (401, 403, 500)

Answer

filter status_code MATCHES [401|403|500]

Answer

filter status_code == (401, 403, 500)

Question 9

An analyst wants to reshape query results to display statistical summaries. Which TWO commands are commonly used for data aggregation and shaping in XQL? (Choose two)

Accepted Answer

sort. Data aggregation uses the 'stats' command, and sorting uses the 'sort' command.

Answer

group_by

Answer

stats

Answer

aggregate

Answer

compile

Question 10

When working with array fields in XQL records, which THREE functions or commands can be used to manipulate or inspect arrays? (Choose three)

Accepted Answer

arrayexpand. Option C, arrayexpand, is correct because it is an XQL command that expands each element of an array field into separate rows, allowing array contents to be manipulated and inspected row by row. Option D, array_length(), is correct because it is an XQL function that returns the number of elements in an array field, which is exactly how you inspect an array's size. Option E, array_flatten(), is correct because it is an XQL function that flattens nested arrays into a single-level array, a standard array manipulation operation. Options A and B do not belong: array_compile() and array_destroy() are not XQL array functions, and no such array-manipulation functions exist in the XQL function set.

Answer

array_compile()

Answer

array_destroy()

Question 11

A security analyst is building a correlation rule in XSIAM that requires enriching incoming firewall logs with asset criticality information stored in a lookup table named `asset_inventory`. The lookup table has columns `ip_address` and `criticality`. The analyst wants to add the `criticality` field to each event where the source IP matches an entry in the lookup table. Which XQL command should be used to perform this enrichment?

Accepted Answer

lookup asset_inventory ip_address as src_ip output criticality. The `lookup` command is the correct XQL mechanism for enriching events with data from a lookup table. It matches a field in the event stream to a column in the lookup table and appends specified output fields. This approach is efficient and purpose-built for reference data enrichment, unlike joins or invalid commands.

Answer

join type=left asset_inventory on src_ip = ip_address

Answer

enrich asset_inventory on src_ip = ip_address with criticality

Answer

alter criticality = asset_inventory.criticality where src_ip = asset_inventory.ip_address

Question 12

An analyst is investigating lateral movement and wants to identify the first time each source host was seen communicating with a suspicious destination over the last 30 days. The dataset contains millions of events. Which XQL approach most efficiently returns one row per source host showing its earliest connection timestamp?

Accepted Answer

Use the `sort` stage on the timestamp field in ascending order, then apply `dedup` on the source host field.. To return the first-seen timestamp per source host, the analyst should order events by timestamp ascending and then deduplicate on the source host. This preserves the full event context of the earliest connection while collapsing the result to one row per host, which is efficient and directly answers the lateral movement question.

Answer

Use the `join` stage to combine the dataset with itself on the source host field and select the minimum timestamp.

Answer

Use the `stats` stage with `min(timestamp)` grouped by the source host field.

Answer

Use the `filter` stage to keep only events where the timestamp is greater than the current time minus 30 days.

Question 13

An analyst is investigating a series of failed login attempts and wants to identify users who have experienced more than 10 failed logins from different source IP addresses within the last hour. The analyst writes an XQL query but needs to ensure that only users with a high number of distinct source IPs are returned. Which XQL function should be used in the `stats` command to count the distinct source IPs per user?

Accepted Answer

dc(src_ip). The `dc()` function is the correct XQL aggregate for counting distinct values. In the `stats` command, `dc(src_ip)` counts unique source IPs per user, allowing the analyst to filter for users with more than 10 distinct IPs. Other options are invalid function names that would cause query errors.

Answer

distinct_count(src_ip)

Answer

count_distinct(src_ip)

Answer

unique(src_ip)

Question 14

An analyst is investigating a suspected data-exfiltration incident and needs to identify internal hosts that transferred more than 500 MB to external IP addresses during a 24-hour window. The relevant events reside in the `xdr_data` dataset, which contains the fields `action_local_ip`, `action_remote_ip`, `action_external`, and `bytes_sent`. Which XQL query correctly produces the list of internal hosts exceeding the threshold?

Accepted Answer

dataset = xdr_data | filter action_external = true | filter _time > timestamp("2024-06-01 00:00:00") and _time < timestamp("2024-06-02 00:00:00") | stats sum(bytes_sent) as total_bytes by action_local_ip | filter total_bytes > 500000000. The correct query filters events to external traffic within a specific 24-hour window, aggregates total bytes sent per internal host using the `stats` command, and then applies a threshold of 500,000,000 bytes. The other options either aggregate on the wrong field, omit the time window, or apply the threshold incorrectly, failing to identify internal hosts that exceeded the threshold.

Answer

dataset = xdr_data | filter action_external = true | comp sum(bytes_sent) as total_bytes by action_local_ip | filter total_bytes > 524288000

Answer

dataset = xdr_data | filter action_external = true | stats sum(bytes_sent) as total_bytes by action_remote_ip | filter total_bytes > 500000000

Answer

dataset = xdr_data | filter action_external = true and bytes_sent > 0 | bin _time span = 24h | stats sum(bytes_sent) as total_bytes by action_local_ip, _time | filter total_bytes > 500000000

Question 15

An analyst needs to build a scheduled XQL query that flags any process execution where a parent process named 'winword.exe' spawned a child process, but only when the two events occur within 30 seconds of each other on the same endpoint. The analyst wants to correlate parent and child events without relying on a pre-existing causality field. Which XQL capability should the analyst use to pair these events based on time proximity and a shared endpoint identifier?

Accepted Answer

The transaction stage with a time window and grouping by the endpoint identifier. The transaction stage is purpose-built for grouping related events that occur close together in time, using a grouping key and a maximum time gap. In this scenario, grouping by endpoint identifier and setting a 30-second window allows the query to associate a parent process event with a subsequent child process event, even without a causality field. Other stages like join, stats, or dedup do not evaluate temporal proximity between events in the same way.

Answer

The join stage with a time-based condition and matching on the endpoint identifier

Answer

The stats stage with a count aggregation and a group-by on the endpoint identifier

Answer

The dedup stage with a time-based sort and a limit on the endpoint identifier