CCSE-204試験無料問題集（64題）「CrowdStrike Certified SIEM Engineer 認定」

出題：1

You are creating a correlation rule in Next-Gen SIEM to trigger alerts based on when the event occurred, regardless of when the event was ingested.
Which event timestamp should you select?

A. @systemtimestamp

B. @timestamp

C. @localtimestamp

D. @ingesttimestamp

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

What is the maximum number of active correlation rules in a CID?

A. 1000

B. 750

C. 250

D. 500

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

You want a Next-Gen SIEM dashboard to update automatically when new data is available.
Which action would you take?

A. Change the "Fixed Time Range" to the current date

B. Toggle the "Live" button to on

C. Change the "Relative Time Range" interval to 1 millisecond ago

D. Change the "Start Time" interval to 1 hour

正解：B 解答を投票する

出題：4

Which CPS-compliant practice should be followed when a third-party field has no matching ECS field?

A. Convert it to @timestamp

B. Remove the field entirely

C. Save it only in an external lookup table

D. Prefix it with Vendor.

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

What is the recommended order of the three required activities to build an efficient CQL query?

A. Format > Filter > Aggregate

B. Filter > Aggregate > Format

C. Filter > Format > Aggregate

D. Aggregate > Filter > Format

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

What is the most appropriate action if a third-party connector is disconnected and no longer ingesting data?

A. Change all searches to Falcon-only data

B. Ignore it until the monthly ingestion report updates

C. Review connector health and reconnect or reauthorize the integration

D. Delete the related parser immediately

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：7

You need to ingest a data source into Next-Gen SIEM. There is a prebuilt Pull connector.
What is required to configure the connector?

A. Falcon API URL

B. Data Source API key

C. Falcon Log Collector hostname

D. HEC token

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

CCSE-204試験無料問題集「CrowdStrike Certified SIEM Engineer 認定」