CrowdStrike Certified SIEM Engineer (CCSE-204) Free Practice Test

Question 1

A security analyst observes multiple failed logins followed by a successful login from a new geographic location within a short timeframe across several endpoints.

A. Malware execution

B. Data exfiltration

C. Phishing attack

D. Credential stuffing or account compromise

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

What is the correct mode to enroll LogCollector into Fleet Management with configuration of the log sources stored and managed centrally in Next-Gen SIEM?

A. Complete

B. Central

C. Full

D. localConfig

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

Which default parser would you use to parse the log event below?
Jan 15 14:22:07 host1 sshd[1234]: Failed login

A. JSON

B. Regex

C. Key-value

D. Syslog

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

What are the two types of connectors used to integrate data between third-party systems and Falcon?

A. Push and Pull

B. Syslog and Application Programming Interface (API)

C. Internal and External

D. On-Prem and Cloud

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

An analyst notices that certain critical logs are missing from SIEM during a security incident due to misconfigured log forwarding.

A. Disable logs

B. Validate log pipeline and forwarding configuration

C. Increase alerting

D. Ignore issue

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

You find a Falcon Log Collector instance on a Linux system that is not connected to Fleet Management.
What command would you use to enroll the Falcon Log Collector?

A. sudo logscale-collector enroll <TOKEN>

B. "C:\Program Files (x86)\CrowdStrike\Humio Log Collector\humio-log-collector.exe" enroll <TOKEN>

C. sudo humio-log-collector --token <TOKEN> enroll

D. sudo humio-log-collector enroll <TOKEN>

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

Which two tags are compliant with the CrowdStrike Parsing Standard (CPS)?

A. #vendor.name and #event.type

B. #event.type and #event.kind

C. #observer.type and #event.kind

D. #observer.type and #vendor.name

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

Following the principle of least privilege, which is the appropriate role to grant a Falcon Next-Gen SIEM user the permissions to read case data and write XDR data while denying the permission to write case templates?

A. NGSIEM Administrator

B. NG SIEM Security Lead

C. NG SIEM Analyst - Read Only

D. NG SIEM Analyst

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

CrowdStrike Certified SIEM Engineer (CCSE-204) Free Practice Test