あなたを合格させるCCSE-204試験問題集で使おう（更新された64問があります)
CCSE-204試験問題集でCrowdStrike練習テスト問題
質問 # 21
What dashboard presents a view of third-party data ingestion over the past 30 days?
- A. Next-Gen SIEM Connector Dashboard
- B. Falcon Flex Dashboard
- C. Sensor Usage Dashboard
- D. Sensor Subscription Dashboard
正解：A
解説：
The correct answer is D. Next-Gen SIEM Connector Dashboard .
CrowdStrike describes the Falcon Next-Gen SIEM Connector Dashboard as the place to understand the status and volume of data ingestion for third-party sources. This matches the question's requirement for a dashboard showing third-party ingestion visibility.
The other options are not aimed at third-party SIEM connector ingestion monitoring:
* Sensor Usage Dashboard relates to Falcon sensor usage, not connector-based third-party ingestion.
* Sensor Subscription Dashboard is about licensing/subscription counts.
* Falcon Flex Dashboard is related to subscription consumption and commercial usage, not connector ingestion telemetry.
質問 # 22
You are reviewing logs and find that the content appears as one large block of text within the @rawstring field for incoming firewall logs. The other expected structured fields are empty.
What is the cause of this issue?
- A. The timestamp format is incorrect
- B. The parser was incorrect
- C. The ingestion token is invalid
- D. The sink was overloaded
正解：B
解説：
The correct answer is A. The parser was incorrect .
CrowdStrike LogScale documentation explains that when data is ingested without an appropriate parser , the event still arrives in LogScale, but it is not automatically parsed into fields . In that case, the event remains as raw text in @rawstring, while the expected extracted fields stay empty. That matches the exact symptom described in the question.
Why the other options are incorrect:
B is incorrect because if the ingestion token were invalid, the data generally would not be ingested successfully in the first place. C is incorrect because an overloaded sink may delay or buffer delivery, but it does not explain why only @rawstring is populated while structured fields are missing. D is incorrect because a timestamp parsing problem may cause time-related errors, but it would not by itself explain why the entire firewall event remains unparsed as raw text. CrowdStrike's parser error docs show that parse failures are tracked separately and that @rawstring is what you inspect when events fail to parse correctly.
質問 # 23
Which combination of scope and permissions must be configured to create an API token that allows you to create and get the results of a query job in Next-Gen SIEM?
- A. NGSIEM with both read and write permissions
- B. NGSIEM with both write and execute permissions
- C. NGSIEM with write permissions only
- D. NGSIEM with read permissions only
正解：A
解説：
The correct answer is C. NGSIEM with both read and write permissions .
CrowdStrike integration guidance for querying Next-Gen SIEM event data states that the API client needs the NGSIEM scope with both Read and Write permissions . The documentation explains why: Write is required to create the search/query job, and Read is required to retrieve the query results.
Why the other options are incorrect:
A is incorrect because the documented requirement is Read + Write ; there is no documented "execute" permission in the cited guidance. B is incorrect because read-only access would let you read results but not create the query job. D is incorrect because write-only access would let you submit the job but not read the results back.
質問 # 24
You want a Next-Gen SIEM dashboard to update automatically when new data is available.
Which action would you take?
- A. Change the "Fixed Time Range" to the current date
- B. Change the "Relative Time Range" interval to 1 millisecond ago
- C. Toggle the "Live" button to on
- D. Change the "Start Time" interval to 1 hour
正解：C
質問 # 25
Following the principle of least privilege, which is the appropriate role to grant a Falcon Next-Gen SIEM user the permissions to read case data and write XDR data while denying the permission to write case templates?
- A. NG SIEM Analyst
- B. NGSIEM Administrator
- C. NG SIEM Analyst - Read Only
- D. NG SIEM Security Lead
正解：A
解説：
The best answer is C. NG SIEM Analyst .
I need to be careful here: I did not find a public CrowdStrike permissions matrix that explicitly lists this exact combination of rights by role. So this answer is the best-supported least-privilege inference , not one I can claim is directly documented 100%.
Why C is the strongest choice:
* NG SIEM Analyst - Read Only would not fit because the question requires write XDR data permissions.
* NGSIEM Administrator and NG SIEM Security Lead are broader roles and would not satisfy least privilege if a narrower analyst role can do the job.
* That leaves NG SIEM Analyst as the most plausible least-privilege built-in role for reading case data and writing XDR data while not granting broader administrative capabilities. CrowdStrike's Next-Gen SIEM materials describe the platform as combining centralized case management and XDR workflows, but the public pages I found do not expose the exact internal role matrix.
質問 # 26
You want a consistent view of events from various data sources.
Which ECS field type should you normalize?
- A. Base Fields
- B. Extended Fields
- C. Core Fields
- D. Detection Fields
正解：C
解説：
Elastic's official ECS guidelines define Core fields as the fields most common across use cases and explicitly state that analysis content built on these fields should work properly on data from any relevant source. They also say to focus on populating these fields first . CrowdStrike's CPS builds on ECS and is intended to standardize field names and structures across different data sources for consistent searching and analysis.
Together, that makes Core fields the right answer when your goal is a consistent cross-source view.
Why the other options are incorrect:
* Extended fields are useful, but ECS defines them as anything not in the core set, so they are not the primary normalization target for broad consistency.
* Base fields and Detection fields are not the correct ECS field-type answer to this question as framed.
質問 # 27
Review the log event below:
{"ts": "2018/11/01 14:31:10", "server": "web01", "message": "Out of memory"} Which parsing function is correct to add a missing timezone field?
- A. kvParse() | findTimestamp(field=ts, timezone="Europe/London")
- B. parseJson() | parseTimestamp("yyyy/MM/dd HH:mm:ss", timezone="Europe/Paris", field=ts)
- C. parseJson() | parseTimestamp("dd/MMM/yyyy:HH:mm:ss Z", timezone="Europe/Paris", field=ts)
- D. kvParse() | findTimestamp(timezone="America/New_York")
正解：B
解説：
The correct answer is D . CrowdStrike LogScale's timestamp parsing documentation gives this exact pattern as the example for a JSON event whose ts field contains 2018/11/01 14:31:10 with no timezone present. The documented solution is:
parseJson() | parseTimestamp("yyyy/MM/dd HH:mm:ss", timezone="Europe/Paris", field=ts) This works because the event is JSON, so parseJson() is the right first step, and the timestamp format matches the sample exactly. Since the timestamp string does not include timezone information, CrowdStrike documentation says you must provide a timezone parameter to parseTimestamp().
Why the other options are incorrect:
A is wrong because the format string does not match the timestamp. The event uses 2018/11/01 14:31:10, which is yyyy/MM/dd HH:mm:ss, not dd/MMM/yyyy:HH:mm:ss Z. Also, the sample timestamp does not include a Z timezone token in the raw string. B and C are wrong because kvParse() is for key-value logs, not JSON logs, and this event is clearly JSON. CrowdStrike's built-in parser documentation distinguishes JSON parsing from KV parsing, and the timestamp example for missing timezone specifically uses parseJson() with parseTimestamp().
質問 # 28
What is true about first-party data from the Falcon platform and its integration into Next-Gen SIEM?
- A. It is instantly accessible within Next-Gen SIEM
- B. First-party data requires a log collector installation
- C. It is quickly ingested to Next-Gen SIEM via a third-party integration
正解：A
解説：
The correct answer is C. It is instantly accessible within Next-Gen SIEM .
CrowdStrike states that Falcon Next-Gen SIEM provides instant availability of first-party data , including native CrowdStrike telemetry such as endpoint, cloud, and identity data. This means first-party Falcon data does not require a separate onboarding step like third-party sources often do.
Why the other options are incorrect:
A is incorrect because first-party Falcon telemetry does not require a separate log collector installation to become available inside the platform. B is incorrect because the question is about first-party data, not third- party integration. CrowdStrike distinguishes native Falcon telemetry from externally integrated log sources.
質問 # 29
You are reviewing a lookup file to determine whether an event was successfully parsed during ingestion.
Which metadata field indicates the event's parsing status?
- A. @event_parsed
- B. @ingesttimestamp
- C. @error_msg
- D. @rawstring
正解：A
解説：
The correct answer is D. @event_parsed .
CrowdStrike LogScale's parser error documentation explicitly states that @event_parsed indicates whether the event has been successfully parsed during ingest . The same documentation says it is set to false when there was a parsing error. That exactly matches the question.
Why the other options are incorrect:
@ingesttimestamp represents the time the platform ingested the event, not whether parsing succeeded.
@rawstring contains the original raw event data. @error_msg can contain error details, but it is not the primary field that directly indicates parse success or failure. The field CrowdStrike documents for parsing status is @event_parsed .
質問 # 30
How does a first-party detection differ from a third-party detection?
- A. First-party detections are a higher severity than third-party detections and should be triaged first
- B. First-party detections are those native to the platform, while third-party detections are generated from data sources external to the platform
- C. First-party detections can be seen by all users, while third-party detections require special roles and permissions to be viewed
- D. First-party detections are those native to the platform, while third-party detections are those created by the customer's security team
正解：B
解説：
The correct answer is D .
CrowdStrike's Falcon Next-Gen SIEM materials distinguish between CrowdStrike detections and third- party detections , and also state that Falcon Next-Gen SIEM extends data collection to third-party data sources . That means first-party detections are native to the Falcon platform, while third-party detections originate from data sources outside the platform that have been onboarded into Next-Gen SIEM.
Why the other options are incorrect:
A is wrong because third-party detections are not defined as detections created by the customer's team.
B is wrong because the distinction is not based on visibility permissions.
C is wrong because CrowdStrike does not define first-party detections as inherently higher severity than third- party detections.
質問 # 31
You need to import a pre-built workflow into Fusion SOAR to automate a part of your incident response process.
Which file format would you use?
- A. .JSON
- B. .YAML
- C. .PY
- D. .CPP
正解：B
解説：
The best-supported answer is D. .YAML .
CrowdStrike's recent Falcon Fusion SOAR technical content shows workflow structures represented in YAML . In particular, CrowdStrike's workflow-based pagination example for Falcon Fusion SOAR says,
"The following YAML shows the workflow structure," and then provides the workflow definition in YAML form. That indicates YAML is the workflow definition format used in documented examples for reusable/pre- built workflow structures.
Why the other options are incorrect:
A (.CPP) and C (.PY) are programming language source files, not workflow import formats for Fusion SOAR. B (.JSON) is heavily used elsewhere in the platform for schemas, API payloads, and structured data, but the CrowdStrike materials I found that specifically show workflow structure present it in YAML , not JSON. Based on that documented workflow representation, .YAML is the correct answer here.
質問 # 32
Which field is compliant with CrowdStrike Parsing Standard (CPS)?
- A. Parser.type
- B. Parser.name
- C. #event.trigger
- D. #event.dataset
正解：D
解説：
The correct answer is B. #event.dataset .
CrowdStrike's CPS documentation explicitly lists #event.dataset as one of the CPS-compliant parser tags.
The CPS migration documentation also repeats that CPS-compliant parsers use tags for fields including #ecs.
version , #event.dataset , and #event.kind .
Why the other options are incorrect:
Parser.type and Parser.name are not listed as CPS-compliant tags in the CPS standard.
#event.trigger is also not listed among the CPS-compliant fields/tags.
Therefore, the only CPS-compliant option given is #event.dataset .
質問 # 33
What is the recommended order of the three required activities to build an efficient CQL query?
- A. Aggregate > Filter > Format
- B. Format > Filter > Aggregate
- C. Filter > Aggregate > Format
- D. Filter > Format > Aggregate
正解：C
解説：
The correct answer is B . CrowdStrike's query best-practices documentation says to filter first , then do transformations/formatting, then aggregate , and finally do any output-style post-processing such as table
/sorting. Among the choices given, Filter > Aggregate > Format is the best match because formatting/output belongs at the end for efficiency.
This is also consistent with CrowdStrike's explanation that CQL pipelines chain filter and transformation steps before aggregate functions, and that aggregate functions produce new result structures rather than raw events.
質問 # 34
Which Falcon LogScale Collector mode keeps the log source configuration stored locally on the collector host instead of centrally in Fleet Management?
- A. central
- B. collectorOnly
- C. localConfig
- D. full
正解：C
解説：
In Fleet Management enrollment, localConfig keeps the collector's source configuration stored and managed locally on the host. By contrast, full mode stores and manages the configuration centrally in Next-Gen SIEM / Fleet Management. This distinction is important when choosing between centralized and host-local administration.
質問 # 35
Which are valid parse functions in CQL?
- A. parseIETF()
parseJson()
parseXml( - B. parseCEF()
parseJson()
parseXml() - C. parseCEF()
parseIETF()
parseXml() - D. parseCEF()
parseIETF()
parseJson()
正解：B
解説：
The correct answer is B . CrowdStrike LogScale documentation includes parseCEF() , parseJson() , and parseXml() as valid parsing functions. parseCEF() parses CEF-encoded messages, parseJson() parses JSON data into fields, and parseXml() parses XML content into fields.
The other options are incorrect because parseIETF() is not a valid CQL parse function in the documented parsing function set, and option D also contains malformed syntax with parseXml(.
質問 # 36
The parseJson() function would be used to parse which log message format from the list below?
- A. { "level": "info", "msg": "User login", "user": "john_doe" }
- B. level=debug msg="Disconnected" host=app01
- C. 2024-05-10T14:23:11Z INFO Service started
- D. 192.168.1.1 [192.168.1.1] - - [10/May/2024:14:23:11 +0000] "GET/index.html"
正解：A
解説：
The correct answer is C . CrowdStrike documents parseJson() as the function used to parse data or a field as JSON , converting JSON objects into named fields. The JSON example in the docs matches the structure of option C.
The other options are not JSON. A is key-value style text, B is access-log style text, and D is plain text with a timestamp and message. Those would require other parsing approaches, not parseJson().
質問 # 37
Which function is most appropriate for extracting fields from logs formatted as key=value pairs?
- A. parseCsv()
- B. kvParse()
- C. parseJson()
- D. parseXml()
正解：B
解説：
kvParse() is designed for logs that use key=value structure. It extracts the keys and values into searchable fields. parseJson() is for JSON objects, parseCsv() is for delimited positional records, and parseXml() is for XML-formatted content.
質問 # 38
Which combination of scope and permissions must be configured to create an API token that allows you to create and get the results of a query job in Next-Gen SIEM?
- A. NGSIEM with both read and write permissions
- B. NGSIEM with both write and execute permissions
- C. NGSIEM with write permissions only
- D. NGSIEM with read permissions only
正解：A
質問 # 39
Which CQL function should you use to count events by hostname?
- A. kvParse()
- B. parseJson()
- C. table()
- D. groupBy()
正解：D
解説：
The groupBy() function is used to aggregate events by one or more fields, such as hostname, and return counts or other aggregate calculations. table() displays selected fields but does not perform grouped aggregation. parseJson() and kvParse() are parsing functions, not aggregation functions.
質問 # 40
Which Falcon LogScale Collector output format would you use if your downstream SIEM requires raw nested event data?
- A. JSON
- B. CEF
- C. LEEF
- D. Syslog
正解：A
解説：
CrowdStrike SIEM Connector and LogScale guidance states that JSON output preserves the raw nested JSON structure of incoming event data. This is the correct choice when a downstream system expects full nested event content instead of flattened key-value pairs. Syslog, CEF, and LEEF are transformation formats intended for compatibility with other log analysis tools and normalized ingestion workflows.
質問 # 41
Which command helps visualize in real time whether sources and sinks are working properly in the Log Collector?
- A. logscale-collector monitor
- B. journalctl -u logscale-collector
- C. logscale-collector --status
- D. logscale-collector check
正解：A
解説：
The correct answer is B .
CrowdStrike's Falcon LogScale Collector debug documentation says the monitor command launches a monitor terminal application and can be used to see a live view of the running state of the collector. It explicitly states that the running sources, queues and sinks can be inspected in real time . That exactly matches the question.
Why the other options are incorrect:
A can help review service logs, but it is not the documented real-time visualization command for sources and sinks.
C and D do not match the documented command for this purpose in the collector troubleshooting documentation.
質問 # 42
What is the primary benefit of utilizing Next-Gen SIEM's built-in dashboards?
- A. Custom queries for specific events
- B. Quick insights without manual setup
- C. Capability to modify dashboard source code
- D. Direct access to raw log data
正解：B
解説：
The correct answer is C. Quick insights without manual setup .
CrowdStrike describes Falcon Next-Gen SIEM as providing pre-built dashboards and says teams can quickly understand security and system health with prebuilt dashboards for data collection health, SOAR workflow executions, security trends, and more. That directly supports the idea that the main benefit is getting fast visibility and insights without having to build everything manually first .
Why the other options are incorrect:
A is incorrect because dashboards are for visualization and insight, not primarily for raw log access. B is incorrect because custom queries are a separate search capability, not the main value proposition of built-in dashboards. D is incorrect because CrowdStrike emphasizes using pre-built and custom dashboards for visualization, not modifying dashboard source code as the primary benefit.
質問 # 43
You are creating a dashboard in Next-Gen SIEM and want to change the visualization used by a widget.
What must be selected to make this change?
- A. Edit in Search view
- B. Interactions options
- C. Styling options
正解：C
解説：
The correct answer is C. Styling options .
CrowdStrike LogScale dashboard training documentation says the Styling panel is where you modify widget properties and, for widgets like a Time Chart, change how the graph is displayed . That aligns with changing the widget's visualization. By contrast, Interactions is for widget interaction behavior, and Edit in Search view is for editing the underlying search rather than changing the visualization style.
質問 # 44
Which sequence correctly describes the process for duplicating a workflow in Fusion SOAR?
- A. Go to Fusion SOAR > Fusion SOAR > Workflows > Click Open (three dots) menu for the workflow you want to duplicate > Click "Duplicate workflow" > Update and rename the duplicated workflow > Click Save and exit to save the updated workflow
- B. Go to Fusion SOAR > Fusion SOAR > Workflows > Select the checkbox next to the workflow you want to duplicate > Click "Actions" at the top of the page > Select "Create Copy" > Edit workflow name and description > Configure trigger conditions > Click Next > Review workflow canvas > Click Finish
- C. Go to Fusion SOAR > Fusion SOAR > Workflows > Find the workflow to duplicate > Click the workflow name > Select "Duplicate" from Actions menu > Edit the workflow configuration > Click
"Create" to generate the new workflow > Set Status to On - D. Go to Fusion SOAR > Workflow Management > Select "All Workflows" tab > Right-click on the workflow to duplicate > Select "Clone Workflow" > Modify workflow parameters > Click "Validate" > Set workflow status > Click Apply Changes
正解：A
解説：
The correct answer is C . CrowdStrike Fusion SOAR workflow management uses the Workflows page as the central location for workflow operations, and workflow editing actions are performed from the workflow's action menu. The duplicate process aligns with opening the workflow options menu, selecting Duplicate workflow , updating the duplicated workflow, and then using Save and exit to preserve the changes. This sequence reflects the expected workflow-management flow in Falcon Fusion SOAR.
質問 # 45
......
あなたをお手軽に合格させるCCSE-204試験正確なPDF問題：https://jp.fast2test.com/CCSE-204-premium-file.html