CrowdStrike CCSE - CrowdStrike Certified SIEM Engineer Exam
Page: 3 / 12
Total 60 questions
Question #11 (Topic: Exam A)
What is the time format for the @timestamp field when data is parsed using the CrowdStrike Parsing Standard (CPS)?
A. ISO 8601
B. Unix Time in microseconds
C. Human-readable
D. Unix Time in milliseconds
Answer: A
Question #12 (Topic: Exam A)
Which CQL statement below includes correct placement of the AND statements and the pipe symbol?
A. #sourcefile="jobfilename" AND stdout=/\[[\+]\]/ | groupBy([hostname], function=collect([hostname,stdout])) AND stdout != "" AND stdout != "* No artifacts *" | select([hostname,stdout])
B. #sourcefile="jobfilename" | stdout=/\[[\+]\]/ | groupBy([hostname], function=collect([hostname,stdout])) | stdout != "" AND stdout != "* No artifacts *" AND select([hostname,stdout])
C. #sourcefile="jobfilename" AND stdout=/\[[\+]\]/ | groupBy([hostname], function=collect([hostname,stdout])) | stdout != "" AND stdout != "* No artifacts *" | select([hostname,stdout])
D. #sourcefile="jobfilename" | stdout=/\[[\+]\]/ AND groupBy([hostname], function=collect([hostname,stdout])) AND stdout ! = "" | stdout != "* No artifacts *" | select([hostname,stdout])
Answer: C
Question #13 (Topic: Exam A)
A correlation rule is generating a high volume of detections. You have been asked to temporarily deactivate it so your team can investigate.
What will happen to previously generated detections while the rule is in a deactivated state?
What will happen to previously generated detections while the rule is in a deactivated state?
A. They will not be impacted and will remain within the console
B. Their status will change to closed and tagged as true positives in the console
C. Their status will change to closed and tagged as false positives in the console
D. They will be immediately deleted from the console
Answer: A
Question #14 (Topic: Exam A)
What is the recommended order of the three required activities to build an efficient CQL query?
A. Filter > Format > Aggregate
B. Filter > Aggregate > Format
C. Format > Filter > Aggregate
D. Aggregate > Filter > Format
Answer: B
Question #15 (Topic: Exam A)
You have been tasked with parsing the following space delimited log:
2025-06-03 12:13:07 johndoe 192.168.5.15 login
The log source data is guaranteed to always be in the same order.
Which function can parse this log?
2025-06-03 12:13:07 johndoe 192.168.5.15 login
The log source data is guaranteed to always be in the same order.
Which function can parse this log?
A. parseCEF()
B. parseJson()
C. parseCsv()
D. parseFixedWidth()
Answer: C
