Falcon SIEM Engineer CCSE-200 Practice Questions & Answers • ExamPrepare

34 questions in this view

Page 1 of 6

Question 1

How closely did the questions on the exam align to your experience as a Next-Gen SIEM Engineer?

Very aligned
Somewhat aligned
Not at all aligned

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

Which statement is accurate about how data ingest is measured and represented in Next-Gen SIEM?

Average GB/day for third-party sources only (pre-parsing)
Average GB/day for all sources (pre-parsing)
Average GB/month for first and third-party sources (pre-parsing)
Average GB/month for all sources (post-parsing)

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

What is true about first-party data from the Falcon platform and its integration into Next-Gen SIEM?

It is instantly accessible within Next-Gen SIEM
It is quickly ingested to Next-Gen SIEM via a third-party integration
First-party data requires a log collector installation

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

As a Next-Gen SIEM Engineer, you are responsible for managing and tuning correlation rules to improve the detection of potential security incidents. One of your correlation rules is designed to detect multiple failed login attempts that are followed by a successful login within a short time frame.

Which step would you take to tune this correlation rule to reduce false positives while maintaining its effectiveness?

Add a condition to exclude known trusted IP addresses from triggering the rule
Increase the time window for detecting multiple failed login attempts to capture more data
Decrease the threshold for the number of failed login attempts required to trigger the rule
Remove the condition for a successful login to simplify the rule

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

Which default parser would you use to parse the log event below?

Jan 15 14:22:07 host1 sshd[1234]: Failed login

Syslog
Key-value
JSON
Regex

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.