CCSE-204 Exam Training Practice Tests (CrowdStrike Certified SIEM Engineer)]

Question 1

Which function is most appropriate for extracting fields from logs formatted as key=value pairs?

A. kvParse() B. parseCsv() C. parseJson() D. parseXml()

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

The parseJson() function would be used to parse which log message format from the list below?

A. 2024-05-10T14:23:11Z INFO Service started B. 192.168.1.1 [192.168.1.1] - - [10/May/2024:14:23:11 +0000] "GET/index.html" C. level=debug msg="Disconnected" host=app01 D. { "level": "info", "msg": "User login", "user": "john_doe" }

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 3

You find a Falcon Log Collector instance on a Linux system that is not connected to Fleet Management.
What command would you use to enroll the Falcon Log Collector?

A. sudo humio-log-collector enroll < TOKEN > B. sudo logscale-collector enroll < TOKEN > C. "C:\Program Files (x86)\CrowdStrike\Humio Log Collector\humio-log-collector.exe" enroll < TOKEN
> D. sudo humio-log-collector --token < TOKEN > enroll

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

When deploying the Falcon Log Collector using the commands in the CrowdStrike Fleet Management interface, what is the correct service name?

A. flc-api B. humio-collector C. flc-collector D. logscale-collector

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 5

Which are valid parse functions in CQL?

A. parseCEF()
parseIETF()
parseJson() B. parseIETF()
parseJson()
parseXml( C. parseCEF()
parseIETF()
parseXml() D. parseCEF()
parseJson()
parseXml()

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 6

You are reviewing logs and find that the content appears as one large block of text within the @rawstring field for incoming firewall logs. The other expected structured fields are empty.
What is the cause of this issue?

A. The parser was incorrect B. The timestamp format is incorrect C. The ingestion token is invalid D. The sink was overloaded

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

You need to provide a colleague the appropriate role to allow for configuration of connectors and creation of SOAR automations in Next-Gen SIEM.
Which role will provide these permissions while also maintaining least privilege?

A. Falcon Security Lead B. NG SIEM Security Lead C. NG SIEM Analyst D. Custom role

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

CrowdStrike Certified SIEM Engineer - CCSE-204 Exam Practice Test