We're so confident of our products that we provide no hassle product exchange.
CrowdStrike CCSE-204 Exam Overview:
| Certification Vendor: | CrowdStrike |
| Exam Name: | CrowdStrike Certified SIEM Engineer |
| Exam Number: | CCSE-204 |
| Exam Duration: | 90 minutes |
| Available Languages: | English |
| Related Certifications: | CrowdStrike Certified Falcon Administrator (CCFA) CrowdStrike Certified Falcon Hunter (CCFH) |
| Passing Score: | 80% |
| Exam Format: | Multiple Choice, Scenario-Based |
| Certificate Validity Period: | 2 Years |
| Real Exam Qty: | 60 |
| Exam Price: | USD 300 |
| Sample Questions: | CrowdStrike CCSE-204 Sample Questions |
| Exam Way: | Online (Proctored) or Onsite (Testing Center) |
| Pre Condition: | Prior experience with CrowdStrike Falcon platform recommended; CCFA certification preferred. |
| Official Syllabus URL: | https://www.crowdstrike.com/certifications/ |
CrowdStrike CCSE-204 Exam Syllabus Topics:
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Dashboards and Reporting | 20% | - Visualization Techniques
|
| Topic 2: Log Management and Data Collection | 25% | - Data Sources and Connectors
|
| Topic 3: Search and Investigation | 30% | - Incident Investigation
|
| Topic 4: Administration and Maintenance | 25% | - Access Control
|
CrowdStrike Certified SIEM Engineer Sample Questions:
1. Which three System alerts are enabled by default in Next-Gen SIEM for third-party connectors?
A) Alert if daily data ingestion limit exceeded
Alert if monthly data ingestion limit is exceeded
Resolve alerts within 30 days
B) Alert if connector receives no data in 24 hours
Alert if connector is disconnected
Resolve alerts within 30 days
C) Alert if connector receives no data in 24 hours
Alert if daily data ingestion limit exceeded
Alert if monthly data ingestion limit is exceeded
D) Alert if connector is disconnected
Alert if daily data ingestion limit exceeded
Alert if monthly data ingestion limit is exceeded
2. You need to ingest data from a custom internal application hosted on-prem. The application writes logs to a file on a syslog server.
Which data connector would you use?
A) HTTP Event Connector
B) Azure Virtual Machines Data Connector
C) Google Cloud Pub / Sub Data Connector
D) Amazon S3 Data Connector
3. What is the primary benefit of using a Fusion SOAR workflow to integrate Falcon with third-party ticket system?
A) It enables automated creation and management of incident tickets based on detections
B) It allows for manual tracking of Next-Gen SIEM incidents
C) It enables an automated backup system to store and review Next-Gen SIEM data
D) Integration with a third-party ticket system is required for Next-Gen SIEM to function
4. Review the log event below:
{"ts": "2018/11/01 14:31:10", "server": "webOl", "message": "Out of
memory"}
Which parsing function is correct to add a missing timezone field?
parseJson() | parseTimestamp("dd/MMM/yyyy:HH:mm:ss Z",
A) parseJson() | parseTimestamp("yyyy/MM/dd HH:mm:ss",
B) timezone="Europe/Paris", field=ts)
C) timezone="Europe/Paris", field=ts)
kvParse() | findTimestamp(field=ts, timezone="Europe/London")
D) kvParse() | findTimestamp(timezone="America/New_York")
5. What is the time format for the @timestampfield when data is parsed using the CrowdStrike Parsing Standard (CPS)?
A) Unix Time in milliseconds
B) Human-readable
C) ISO 8601
D) Unix Time in microseconds
Solutions:
| Question # 1 Answer: C | Question # 2 Answer: A | Question # 3 Answer: A | Question # 4 Answer: B | Question # 5 Answer: C |
By Bevis
