CCSE-204 CrowdStrike Certified SIEM Engineer Questions and Answers

The correct answer is C. Select “Manage Internal Logging” from the menu .

CrowdStrike LogScale Collector documentation for Fleet Management explicitly describes the steps to enable internal logging from the Fleet view. It says to go to Data Ingest > Fleet Overview , click the ellipsis next to the specific collector instance, and then click Manage Internal Logging . From there, you can enable logging and choose where to send it.

Why the other options are incorrect:

A is incorrect because reinstalling the collector is not required. B is incorrect because the question specifically asks how to do it from the Fleet view , and the documented UI action is through the menu in Fleet Management, not by manually editing the local config. D is incorrect because the documentation does not describe enabling internal logging by restarting the service with a special flag.

==========

The correct answer is A. All . Falcon Next-Gen SIEM is designed to unify first-party Falcon telemetry with third-party ingested data in a single investigation and search experience. When the query needs to include both Falcon Sensor data and third-party connector data, the correct data source selection is the one that includes both categories together, which is All . CrowdStrike describes Next-Gen SIEM as correlating native Falcon data with third-party sources to provide a unified security view.

The correct answer is A. 9 GB .

CrowdStrike’s Falcon LogScale Collector sizing documentation states that memory requirement for memory queues is linearly proportional to the number of sinks plus a constant baseline requirement of 1 GB . The documentation gives a worked example: 1 GB baseline + queue sizes for each sink .

For this question:

Number of sinks = 4

Queue size per sink = 2 GB

Total sink memory = 4 × 2 GB = 8 GB

Add baseline memory = 1 GB

So the minimum memory requirement is:

8 GB + 1 GB = 9 GB .

That is why:

A. 9 GB is correct

B. 12 GB , C. 10 GB , and D. 8 GB are incorrect because they do not match CrowdStrike’s documented sizing formula for memory queues.

The correct answer is B . The best tuning step is to exclude known trusted IP addresses so the rule still detects suspicious sequences while removing known-benign sources of repeated authentication activity. CrowdStrike has publicly documented this tuning principle in detection content guidance, noting that to avoid false positives, organizations may want to exclude certain IP ranges, ASNs, or ISPs from a rule when those sources are expected or trusted. That directly supports the idea that adding a trusted-IP exclusion reduces noise while preserving the core detection logic.

Why the other options are incorrect:

A would usually increase noise because a larger time window captures more benign failed logins. C would also increase false positives because lowering the failed-attempt threshold makes the rule easier to trigger. D weakens the original attack logic by removing the “failed logins followed by success” sequence that makes the rule more specific and meaningful. Keeping the core sequence intact while adding exclusions for known benign sources is the most precise tuning approach.

The correct answer is C . CrowdStrike documents parseJson() as the function used to parse data or a field as JSON , converting JSON objects into named fields. The JSON example in the docs matches the structure of option C.

The other options are not JSON. A is key-value style text, B is access-log style text, and D is plain text with a timestamp and message. Those would require other parsing approaches, not parseJson().

The sample log is a comma-delimited record with values separated by commas, and some fields are enclosed in quotes. That structure matches CSV-style parsing . In CrowdStrike LogScale, parseCsv() is used for delimited logs where fields appear in a consistent order and are separated by a defined delimiter. This fits the sample shown.

Why the other options are incorrect:

A. XML is incorrect because the log does not use XML tags.

C. JSON is incorrect because the log is not in brace-based key/value JSON format.

D. Key-Value is incorrect because the fields are not expressed as key=value pairs; they are positional comma-separated values instead.

The correct answer is A. CrowdStrike Parsing Standard (CPS) compliant parser .

CrowdStrike’s parsing documentation says CPS is used to normalize and validate data so field names and structures are standardized across data sources for more consistent searching and analysis . CPS-compliant parsers also require specific tags and field population rules, which is exactly what makes incoming data searchable and detection-ready in Falcon Next-Gen SIEM.

The other options are not the general standard CrowdStrike uses for detection-ready normalization:

Charlotte AI-generated parser is not the documented parser standard.

VMWare ESXI parser and Linux syslog parser may describe source-specific parsers, but the question asks for the parser type used generally to transform incoming data into normalized, searchable events. That is CPS.

==========

The correct answer is A. Full .

CrowdStrike’s Falcon LogScale Collector Fleet Management enrollment documentation states that the enrollment mode can be full or localConfig , and it specifically defines full as the mode that enrolls the collector into Fleet Management with the configuration of log sources stored and managed centrally in LogScale/Next-Gen SIEM.

Why the other options are incorrect:

B. Complete and C. Central are not documented enrollment mode names. D. localConfig is a valid mode, but CrowdStrike says that mode keeps the log source configuration managed and stored locally on the host , not centrally.

The correct answer is D. Data Source API key .

CrowdStrike’s Next-Gen SIEM onboarding examples for prebuilt connectors show that, for pull-style integrations, you typically provide the API key generated in the external data source so Falcon Next-Gen SIEM can connect and start ingesting data. For example, CrowdStrike’s Abnormal integration walkthrough says to enter the API key you generated , after which Falcon Next-Gen SIEM automatically connects and starts ingesting data.

Why the other options are incorrect:

A. HEC token is used for HTTP Event Collector push-style ingestion, not for a prebuilt pull connector.

B. Falcon Log Collector hostname is not the standard required credential for configuring a pull connector.

C. Falcon API URL is not the key external credential typically required by these pull connectors.

For prebuilt pull connectors, the required configuration is generally the data source’s API key or equivalent credential .

The correct answer is C. Assignment Operator .

In Falcon LogScale parser and query syntax, the assignment operator := is used to assign a value to a new field. CrowdStrike’s LogScale documentation explains that := is shorthand for eval, and that it can also be used as shorthand with functions that support an as parameter to assign results to a named output field. This is the right approach when you want to create an ECS field while preserving the existing Vendor field , because you are creating an additional field rather than replacing the original one.

Why the other options are not the best answer:

Regular Expression Field Extraction is used to extract values from raw text when the value is not already parsed, so it is not the normal choice when you already have a Vendor field and simply want to map it to an ECS field as well. As Parameter can name the output field of certain functions, but the CrowdStrike documentation for rename() shows that renaming changes the field name, which does not meet the requirement to keep both field names visible. The rename() examples explicitly state that the original field names are replaced with the new field names.

So for a parser requirement that says “add ECS while maintaining Vendor,” the operationally correct method is to assign the Vendor value into a new ECS field , not rename the Vendor field away.

==========

The correct answer is C. NGSIEM with both read and write permissions .

CrowdStrike integration guidance for querying Next-Gen SIEM event data states that the API client needs the NGSIEM scope with both Read and Write permissions . The documentation explains why: Write is required to create the search/query job, and Read is required to retrieve the query results.

Why the other options are incorrect:

A is incorrect because the documented requirement is Read + Write ; there is no documented “execute” permission in the cited guidance. B is incorrect because read-only access would let you read results but not create the query job. D is incorrect because write-only access would let you submit the job but not read the results back.

==========

The correct answer is B . CrowdStrike’s query best-practices documentation says to filter first , then do transformations/formatting, then aggregate , and finally do any output-style post-processing such as table/sorting. Among the choices given, Filter > Aggregate > Format is the best match because formatting/output belongs at the end for efficiency.

This is also consistent with CrowdStrike’s explanation that CQL pipelines chain filter and transformation steps before aggregate functions, and that aggregate functions produce new result structures rather than raw events.

==========

The correct answer is B. sudo logscale-collector enroll < TOKEN > .

Current CrowdStrike LogScale Collector documentation shows the enrollment command using the logscale-collector binary. For example, the macOS custom installation page explicitly shows:

sudo logscale-collector enroll enrolltoken

The Fleet Management enrollment documentation also explains that you copy the enrollment command from the UI and run it on the machine hosting the collector.

Why the other options are incorrect:

A is a Windows path, not Linux. C reflects the older humio-log-collector naming that existed in earlier versions and release history, but the current docs use logscale-collector for the enrollment command. D does not match the documented command syntax. CrowdStrike’s current documentation centers the enrollment workflow on logscale-collector enroll < token > .

==========

The correct answer is A . Deactivating a correlation rule stops it from generating new detections, but previously generated detections remain available in the console for review and investigation. Rule deactivation affects future rule execution state rather than retroactively changing, closing, or deleting detections that have already been created. That is why options B, C, and D are incorrect.

==========

The Falcon SIEM Connector requires an API client with Read access to Event Streams . This permission allows the connector to authenticate to Falcon and receive streaming event data. Other permissions such as Hosts, Incidents, or Detection Management are not the required permission for establishing Falcon event-stream ingestion.

==========