最新的CrowdStrike CCSE認證 CCSE-204考試題庫

問題1

While ingesting Falcon telemetry into a SIEM, analysts notice inconsistent field mappings across different log sources, causing failed correlation rule execution.

A. Disable correlation rules

B. Apply normalization and parsing rules

C. Increase storage capacity

D. Enable encryption

正確答案: B

說明：（僅 VCESoft 成員可見）

問題2

What is the correct mode to enroll LogCollector into Fleet Management with configuration of the log sources stored and managed centrally in Next-Gen SIEM?

A. Full

B. Complete

C. localConfig

D. Central

正確答案: D

說明：（僅 VCESoft 成員可見）

問題3

A SIEM correlation rule triggers when a user logs in from two geographically distant locations within an impossible travel timeframe.

A. Data exfiltration

B. Impossible travel detection

C. Malware infection

D. Privilege escalation

正確答案: B

說明：（僅 VCESoft 成員可見）

問題4

Which CQL statement below includes correct placement of the AND statements and the pipe symbol?

A. #sourcefile="jobfilename" | stdout=/\[[\+]\]/ | groupBy([hostname],
function=collect([hostname,stdout])) | stdout != "" AND stdout != "* No artifacts *" AND select([hostname,stdout])

B. #sourcefile="jobfilename" | stdout=/\[[\+]\]/ AND groupBy([hostname],
function=collect([hostname,stdout])) AND stdout ! = "" | stdout != "* No artifacts *" | select([hostname,stdout])

C. #sourcefile="jobfilename" AND stdout=/\[[\+]\]/ | groupBy([hostname],
function=collect([hostname,stdout])) | stdout != "" AND stdout != "* No artifacts *" | select([hostname,stdout])

D. #sourcefile="jobfilename" AND stdout=/\[[\+]\]/ | groupBy([hostname],
function=collect([hostname,stdout])) AND stdout != "" AND stdout != "*
No artifacts *" | select([hostname,stdout])

正確答案: C

說明：（僅 VCESoft 成員可見）

問題5

Which default parser would you use to parse the log event below?
Jan 15 14:22:07 host1 sshd[1234]: Failed login

A. Key-value

B. Syslog

C. JSON

D. Regex

正確答案: B

說明：（僅 VCESoft 成員可見）

問題6

You clone a default parser and modify only the parseTimestamp()function to accommodate custom time format in your logs.
What is the impact on queries that search for this data?

A. No changes are necessary because all fields will be the same in both parsers

B. The #Cps.versionfield will need to be updated

C. The # character needs to be removed from tagged fields as cloning the parser removes all tagged fields

D. The #typefield will need to be updated

正確答案: A

說明：（僅 VCESoft 成員可見）

問題7

You are onboarding a log source that includes a timestamp with a different timezone.
How should you address any time parsing errors that occur?

A. Clone the parser and drop the timestamp field, use ingesttimestamp instead

B. Clone the parser and change the timestamp field name

C. Clone the parser and manually apply the timezone parameter

D. Adjust the log source to reflect the correct timezone before sending logs

正確答案: C

說明：（僅 VCESoft 成員可見）

問題8

Which three System alerts are enabled by default in Next-Gen SIEM for third-party connectors?

A. Alert if daily data ingestion limit exceeded
Alert if monthly data ingestion limit is exceeded
Resolve alerts within 30 days

B. Alert if connector receives no data in 24 hours
Alert if daily data ingestion limit exceeded
Alert if monthly data ingestion limit is exceeded

C. Alert if connector is disconnected
Alert if daily data ingestion limit exceeded
Alert if monthly data ingestion limit is exceeded

D. Alert if connector receives no data in 24 hours
Alert if connector is disconnected
Resolve alerts within 30 days

正確答案: B

說明：（僅 VCESoft 成員可見）

最新的CrowdStrike Certified SIEM Engineer - CCSE-204免費考試真題

最新更新

站內鏈接

聯系我們