最新的CrowdStrike CCSE-204免費考試真題

問題1

What is the maximum number of active correlation rules in a CID?

A. 250

B. 500

C. 1000

D. 750

正確答案: B

說明：（僅 Fast2test 成員可見）

問題2

Which CPS-compliant practice should be followed when a third-party field has no matching ECS field?

A. Convert it to @timestamp

B. Remove the field entirely

C. Prefix it with Vendor.

D. Save it only in an external lookup table

正確答案: C

說明：（僅 Fast2test 成員可見）

問題3

A parser needs to preserve the original third-party field name and also map it to an ECS-compatible field.
What is the best approach?

A. Keep the original Vendor field and assign its value to a new ECS field

B. Rename the original field to the ECS field

C. Store both values only in @rawstring

D. Delete the original field after mapping

正確答案: A

說明：（僅 Fast2test 成員可見）

問題4

You are creating an AI-generated parser to process and normalize log data from various sources.
How would you ensure the parser accurately interprets and categorizes the log data?

A. Create a set of log examples to match log patterns from different sources

B. Ensure the parser has a minimum of 100 lines

C. Write the parser in a high-level programming language (Python or Java)

正確答案: A

說明：（僅 Fast2test 成員可見）

問題5

The parseJson() function would be used to parse which log message format from the list below?

A. 2024-05-10T14:23:11Z INFO Service started

B. level=debug msg="Disconnected" host=app01

C. { "level": "info", "msg": "User login", "user": "john_doe" }

D. 192.168.1.1 [192.168.1.1] - - [10/May/2024:14:23:11 +0000] "GET/index.html"

正確答案: C

說明：（僅 Fast2test 成員可見）

問題6

Which command helps visualize in real time whether sources and sinks are working properly in the Log Collector?

A. journalctl -u logscale-collector

B. logscale-collector check

C. logscale-collector --status

D. logscale-collector monitor

正確答案: D

說明：（僅 Fast2test 成員可見）

問題7

What is the correct mode to enroll LogCollector into Fleet Management with configuration of the log sources stored and managed centrally in Next-Gen SIEM?

A. localConfig

B. Complete

C. Central

D. Full

正確答案: D

說明：（僅 Fast2test 成員可見）

最新的CrowdStrike Certified SIEM Engineer - CCSE-204免費考試真題

聯系我們

站內鏈接

最新更新