Falcon SIEM Analyst CCSA-200 Practice Questions & Answers • ExamPrepare

32 questions in this view

Page 1 of 6

Question 1

How much experience do you have as a SIEM Analyst?

< 6 months
7–11 months
1–2 years
> 2 years

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

How closely did the questions on the exam align to your experience as a SIEM Analyst?

Very aligned
Somewhat aligned
Not at all aligned

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

You are analyzing a Next-Gen SIEM query result showing authentication events for user account jsmith in the finance department. The query reveals 45 successful authentications across different workstations within a 10-minute window, with each event showing AuthenticationPackageName=NTLM and LogonType=3 (network logon). Historical baseline data in Next-Gen SIEM shows this account typically authenticates to 2–3 systems per day.

What does this pattern indicate?

Lateral movement activity, potentially indicating credential compromise where an attacker is attempting to access multiple systems to locate valuable data or establish persistence
Pass-the-Hash attack where an attacker is using stolen NTLM hashes, but the high volume suggests the attacker is still in the reconnaissance phase mapping the network topology
Legitimate activity from a recently deployed Systems Management tool that uses this account for inventory collection, as LogonType=3 is standard for network-based management operations
Kerberos authentication failure fallback behavior where the account is automatically attempting NTLM authentication after ticket-granting failures, indicating possible time synchronization issues across domain controllers

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

You detect ongoing, unauthorized access spreading across multiple systems in your environment.

What is the appropriate first response action?

Execute workflow to revoke credentials and isolate affected systems
Wait 24 hours to gather additional evidence before taking any action
Monitor the activity but do not take any additional action at this point
Execute workflow to disable all user accounts across the environment

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

When determining the severity of the event, what data does the event.severity field contain?

Numeric severity of the event according to your event source
Keyword severity of the event according to your event source
Numeric severity of the event determined by CrowdStrike
Keyword severity of the event determined by CrowdStrike

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

You are trying to understand detection sources in Next-Gen SIEM. Your organization has configured the following:

• Falcon endpoint sensors on all workstations

• A third-party EDR product sending detections via API

• Correlation rules you built that analyze firewall logs

• A SIEM connector pulling alerts from your cloud provider

Which detection types can appear as a CrowdStrike-generated detection?

Falcon endpoint detections Correlation rule detections
Correlation rule detections SIEM connector
Third-party EDR detections Falcon endpoint detections

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.