TANIUM ESSENTIALS CORE EXAMS MANUAL UPDATED
QUESTIONS AND ANSWERS GRADED A+
✔✔What does the "In" operator do in Tanium? - ✔✔helps to specify a collection of
matching sensor results. This takes comma separated input
✔✔What do nested filters do? - ✔✔help you make questions that include multiple filters
- use question builder for this**
✔✔What is column filtering? - ✔✔this helps regex match results from multi column
sensors. THESE ARE CASE SENSITIVE!!
✔✔How do you separate out the parameterized sensors? - ✔✔With a comma between
them.
For ex: get sensor[Parameter1,Paremeter2,] from all machines
✔✔What do you have to specify when overriding the maxAge in the question Bar? -
✔✔You have to specify a number of seconds
✔✔When specifying case sensitivity what two values can you use? - ✔✔either a 1 or a
0
✔✔When specifying case sensitivity what does 0 mean? - ✔✔This question will be case
sensitive
✔✔When specifying case sensitivity what does 1 mean? - ✔✔this means the results will
be grouped and counted regardless of differences in upper and lower case characters,
NOT CASE SENSITIVE
✔✔Why are questions in the question builder more efficient? - ✔✔because the question
is sent directly to the server without the need of the language parser
✔✔What are the two things you need to specify in the question builder? - ✔✔- the data
elements to be collected
- devices to answer the question
✔✔What interact result message indicates the client is busy? - ✔✔current result
unavailable
✔✔what does reports currently unavailable mean? - ✔✔Server does not have string
✔✔what does too many results mean? - ✔✔the sensor returned more than 1000 rows
from a single machine
, ✔✔What does no results mean? - ✔✔that the sensors returned no values, so the
reported
✔✔What is the default value in the text based search - ✔✔'contains' this can be
changed to does not contain
✔✔Can the text search look multiple patterns at once? - ✔✔No it cannot
✔✔What does TDS mean? - ✔✔Tanium data service, this caches data from last online
machines
✔✔What is the best practice for TDS? - ✔✔Configure for low cardinality sensors that
produce frequently accessed results, such as for daily reports
✔✔What do actions do? - ✔✔Deploy packages to make changes on targeted endpoints
✔✔Are manual groups recommended? - ✔✔No they are not recommended
✔✔How often are new entries added into the action history? - ✔✔each time the action
fires if >= 1 computer reports
✔✔What are the three interact content components? - ✔✔1. categories
2. dashboards
3. Saved questions
✔✔What attributes should you define when creating a saved question? - ✔✔- details
- preferences
- user settings and defaults
- associated actions
✔✔What do dashboards allow? - ✔✔They allow you to group and organize saved
questions for easy and quick access
✔✔What is the overall purpose of Tanium Map? - ✔✔To discover and map multi-tier
application services and server dependencies
✔✔What does Tanium Recorder do? - ✔✔Watches TCP connections on installed
endpoints
✔✔What is the default amount of time that is shown in the graphs through Tanium
Map? - ✔✔24 hours worth of data
QUESTIONS AND ANSWERS GRADED A+
✔✔What does the "In" operator do in Tanium? - ✔✔helps to specify a collection of
matching sensor results. This takes comma separated input
✔✔What do nested filters do? - ✔✔help you make questions that include multiple filters
- use question builder for this**
✔✔What is column filtering? - ✔✔this helps regex match results from multi column
sensors. THESE ARE CASE SENSITIVE!!
✔✔How do you separate out the parameterized sensors? - ✔✔With a comma between
them.
For ex: get sensor[Parameter1,Paremeter2,] from all machines
✔✔What do you have to specify when overriding the maxAge in the question Bar? -
✔✔You have to specify a number of seconds
✔✔When specifying case sensitivity what two values can you use? - ✔✔either a 1 or a
0
✔✔When specifying case sensitivity what does 0 mean? - ✔✔This question will be case
sensitive
✔✔When specifying case sensitivity what does 1 mean? - ✔✔this means the results will
be grouped and counted regardless of differences in upper and lower case characters,
NOT CASE SENSITIVE
✔✔Why are questions in the question builder more efficient? - ✔✔because the question
is sent directly to the server without the need of the language parser
✔✔What are the two things you need to specify in the question builder? - ✔✔- the data
elements to be collected
- devices to answer the question
✔✔What interact result message indicates the client is busy? - ✔✔current result
unavailable
✔✔what does reports currently unavailable mean? - ✔✔Server does not have string
✔✔what does too many results mean? - ✔✔the sensor returned more than 1000 rows
from a single machine
, ✔✔What does no results mean? - ✔✔that the sensors returned no values, so the
reported
✔✔What is the default value in the text based search - ✔✔'contains' this can be
changed to does not contain
✔✔Can the text search look multiple patterns at once? - ✔✔No it cannot
✔✔What does TDS mean? - ✔✔Tanium data service, this caches data from last online
machines
✔✔What is the best practice for TDS? - ✔✔Configure for low cardinality sensors that
produce frequently accessed results, such as for daily reports
✔✔What do actions do? - ✔✔Deploy packages to make changes on targeted endpoints
✔✔Are manual groups recommended? - ✔✔No they are not recommended
✔✔How often are new entries added into the action history? - ✔✔each time the action
fires if >= 1 computer reports
✔✔What are the three interact content components? - ✔✔1. categories
2. dashboards
3. Saved questions
✔✔What attributes should you define when creating a saved question? - ✔✔- details
- preferences
- user settings and defaults
- associated actions
✔✔What do dashboards allow? - ✔✔They allow you to group and organize saved
questions for easy and quick access
✔✔What is the overall purpose of Tanium Map? - ✔✔To discover and map multi-tier
application services and server dependencies
✔✔What does Tanium Recorder do? - ✔✔Watches TCP connections on installed
endpoints
✔✔What is the default amount of time that is shown in the graphs through Tanium
Map? - ✔✔24 hours worth of data
