Consider the search shown below. What is this search's intended function?

Question

Options

• ATo return all the web_log events from the web index that occur two hours before and after the most
• BTo find all the denied, high severity events in the firewall index, and use those events to further
• CTo return all the web_log events from the web index that occur two hours before and after all high
• DTo search the firewall index for web logs that have been denied and are of high severity.

• A
  9% (5)
• B
  32% (18)
• C
  45% (25)
• D
  14% (8)

Explanation

Option C correctly describes a two-stage search: the firewall index is first queried for all high-severity denied events, and those results are used as a subsearch to pull matching web_log events from the web index within a ±2-hour window around each of those events. The plural "all high" is the critical detail - the search fans out across every qualifying firewall event, not just one.

Why the distractors fail:

• A is nearly identical to C but says "the most" (implying a single event, likely the most recent), making it far too narrow - the search targets all matching events, not one.
• B gets the firewall lookup right but mischaracterizes the outcome; the goal is to return the correlated web_log events, not simply to "further" process the firewall events.
• D conflates the two indexes - web logs live in the web index, not the firewall index; D describes a nonsensical single-index search.

Memory tip: Think of this as a "ripple search" - each high-severity firewall event drops a stone, and you catch every web_log that falls within the two-hour ripple around it. If only one stone drops (choice A) or you never look at the web index (choice D), you've misread the pattern.

No community discussion yet for this question.