CrowdStrike Certified SIEM Engineer - CCSE-204 模擬練習
You are configuring third-party data for ingestion. Once a connection is established, you see the HTTP response code 413 as received by your data shipper.
What does this response code indicate?
What does this response code indicate?
正解: A
解説: (PassTest メンバーにのみ表示されます)
The parseJson()function would be used to parse which log message format from the list below?
正解: C
解説: (PassTest メンバーにのみ表示されます)
Which field is compliant with CrowdStrike Parsing Standard (CPS)?
正解: A
解説: (PassTest メンバーにのみ表示されます)
How can you enable internal logging for a specific Falcon Log Collector instance from the Fleet view?
正解: B
解説: (PassTest メンバーにのみ表示されます)
You need to provide a colleague the appropriate role to allow for configuration of connectors and creation of SOAR automations in Next-Gen SIEM.
Which role will provide these permissions while also maintaining least privilege?
Which role will provide these permissions while also maintaining least privilege?
正解: A
解説: (PassTest メンバーにのみ表示されます)
What is the time format for the @timestampfield when data is parsed using the CrowdStrike Parsing Standard (CPS)?
正解: A
解説: (PassTest メンバーにのみ表示されます)
You are reviewing a lookup file to determine whether an event was successfully parsed during ingestion.
Which metadata field indicates the event's parsing status?
Which metadata field indicates the event's parsing status?
正解: A
解説: (PassTest メンバーにのみ表示されます)
An internal security team identified a small number of high-risk users. They ask you to create an app that will monitor these users and trigger an alert when specific suspicious behavior is detected.
Which Falcon feature should you use to develop this app?
Which Falcon feature should you use to develop this app?
正解: A
解説: (PassTest メンバーにのみ表示されます)