CCSE-204 CrowdStrike Certified SIEM Engineer Questions and Answers

The correct answer is C .

CrowdStrike’s CPS documentation explicitly lists the CPS-compliant parser tags, and the relevant four event parser tags in that list are #event.dataset , #event.kind , #event.module , and #event.outcome . That exactly matches option C.

Why the other options are incorrect:

event.category is an important event categorization field in CPS, but it is not one of the four parser tags listed in the CPS tag set that this question is asking about. The documented parser tag list includes event.dataset , event.kind , event.module , and event.outcome .

In the Next-Gen SIEM Connector Dashboard (specifically within the CrowdStrike Falcon ecosystem), the maximum retention period for which you can query third-party data ingestion metrics is 90 days .

Why 90 Days?

While the actual log data (telemetry) in a Next-Gen SIEM can often be retained for a year or longer depending on the subscription (e.g., 365 days), the health and ingestion metrics —which include data such as volume throughput, connector status, and ingestion rates—are typically stored for a shorter duration. This 90-day window is designed to provide enough historical context for:

Troubleshooting: Identifying when a specific connector started failing.

Trend Analysis: Monitoring changes in data volume over a fiscal quarter.

Capacity Planning: Reviewing average ingestion rates to ensure they stay within licensed limits.

Elastic’s official ECS guidelines define Core fields as the fields most common across use cases and explicitly state that analysis content built on these fields should work properly on data from any relevant source. They also say to focus on populating these fields first . CrowdStrike’s CPS builds on ECS and is intended to standardize field names and structures across different data sources for consistent searching and analysis. Together, that makes Core fields the right answer when your goal is a consistent cross-source view.

Why the other options are incorrect:

Extended fields are useful, but ECS defines them as anything not in the core set, so they are not the primary normalization target for broad consistency.

Base fields and Detection fields are not the correct ECS field-type answer to this question as framed.

The correct answer is C. Number of concurrent requests a sink is using .

CrowdStrike’s Falcon LogScale Collector sizing guidance states that in high throughput scenarios where the ingestion endpoint becomes a bottleneck, it can be beneficial to increase the number of concurrent requests a sink is using through the workers setting. The docs explicitly say this helps when the number of parallel requests is limiting throughput.

The same document also explains why D is wrong: increasing the memory queue size does not increase sink throughput. The queue exists to keep data available for the sink; if throughput is lower than the incoming data rate, the queue will eventually fill up anyway.

So:

C is correct because more sink workers can improve performance in high-volume conditions.

D is incorrect because queue size does not fix the throughput bottleneck.

A and B are not the documented tuning setting for this issue in the collector guidance.

==========

@timestamp represents the time the event actually occurred and is the appropriate field for event-time-based detections and correlations. @ingesttimestamp reflects when the platform received the event, which may differ due to delays. @rawstring is raw event content, and @id is not a time field.

==========

The correct answer is C. logscale-collector .

CrowdStrike’s Falcon LogScale Collector installation documentation states that the service name varies by installation method. It explicitly says that for Full Installation the service is called logscale-collector , while Custom Installation uses humio-log-collector . Since the question specifically refers to deployment using the Fleet Management interface commands , that aligns with the Full Installation workflow, so the correct service name is logscale-collector .

==========

The correct answer is C. NGSIEM with both read and write permissions .

CrowdStrike integration guidance for querying Next-Gen SIEM event data states that the API client needs the NGSIEM scope with both Read and Write permissions . The documentation explains why: Write is required to create the search/query job, and Read is required to retrieve the query results.

Why the other options are incorrect:

A is incorrect because the documented requirement is Read + Write ; there is no documented “execute” permission in the cited guidance. B is incorrect because read-only access would let you read results but not create the query job. D is incorrect because write-only access would let you submit the job but not read the results back.

==========

The best answer is D. Custom role .

CrowdStrike documentation for Store app integrations states that the Falcon Administrator role is required to enable apps and plugins in the CrowdStrike Store, which is the administrative side of connector configuration. That shows connector configuration is a privileged task.

At the same time, Falcon Fusion SOAR is the workflow automation capability used to create SOAR automations in the Falcon platform. CrowdStrike describes Fusion SOAR as the workflow engine used to build and run workflows and automate actions across security processes.

Because the question specifically asks for the role that allows both actions while maintaining least privilege , the most appropriate choice is a custom role that grants only the required permissions instead of assigning a broader built-in administrative role. This is an inference from the documented permission model: connector/plugin setup requires elevated permissions, and SOAR workflow creation is a separate capability, so a narrowly scoped custom role is the least-privilege answer among the options.

Why the other options are not the best answer:

NG SIEM Analyst is intended for analyst activity, not configuration and automation administration. Falcon Security Lead is broader and not the most precise least-privilege answer. NG SIEM Security Lead may have wide SIEM access, but the question asks for the option that best maintains least privilege across both connector configuration and SOAR automation creation; that is better satisfied by a custom role . This conclusion is based on the documented need for elevated permissions for plugin configuration and the separate SOAR workflow capability.

==========

The correct answer is B. NG SIEM Security Lead . Parser creation and management requires elevated SIEM content and configuration capabilities that go beyond standard analyst activity, but it does not require the full breadth of platform-wide administrative control. NG SIEM Security Lead is the default role that best fits parser management while still maintaining least privilege compared with NG SIEM Administrator . NG SIEM Analyst and NG SIEM Analyst – Read Only do not provide the content-management level access needed for parser administration. CrowdStrike’s SIEM role separation supports using the Security Lead role for advanced SIEM content configuration tasks.

==========

The correct answer is B. HTTP Event Connector .

CrowdStrike describes the HTTP Event Connector (HEC) as the generic mechanism used to bring third-party data into Falcon Next-Gen SIEM when you need to onboard logs from sources that are not tied to a specific cloud-native connector. CrowdStrike’s own Next-Gen SIEM materials highlight pre-built connectors and HTTP Event Collectors as the way to extend visibility to many different third-party sources.

Because this question describes a custom internal application hosted on-prem , the cloud-specific connectors in options A , C , and D do not fit. The broad, flexible connector option intended for custom or non-native sources is the HTTP Event Connector . Also, CrowdStrike’s vCenter example shows an architecture where logs are first centralized and then onboarded to Falcon Next-Gen SIEM through an HTTP Event Connector , which aligns with this kind of custom-source pattern.

CrowdStrike’s Fleet Management documentation for Falcon LogScale Collector explains that labels are used to associate metadata with a Fleet Management configuration and with collector instances so they can be tagged, identified, organized, and filtered. The docs specifically describe labels as helping organize collectors by criteria such as environment, region, service, or other custom values. That directly matches option B: Categorize collectors for group configurations .

Why the other options are incorrect:

Option A is incorrect because labels are not used for authentication or password management.

Option C is incorrect because labels do not perform traffic monitoring; they are metadata for organization and selection.

Option D is incorrect because labels do not assign network settings such as IP addresses.

The correct answer is A. Regenerate a new API key directly from the platform .

CrowdStrike guidance around connector onboarding shows that after a connector is created, you generate an API key in the platform and use that key for the integration. Related integration guidance also shows a Regenerate API key action in the platform flow, which is the correct response when a key may be exposed or compromised.

Why the other options are incorrect:

B does not address credential compromise; recreating the connector event does not invalidate the exposed key.

C is incorrect because the issue is not viewing or cloning details; the security action is to rotate/regenerate the credential.

D is incorrect because CrowdStrike documentation consistently indicates secrets/keys are generated in-platform and may only be shown once, meaning Support is not the normal mechanism to retrieve and resend an existing secret.

==========

The correct answer is A . CrowdStrike documentation states that when a timestamp does not include timezone information, or when you need to control timezone interpretation, you should pass the timezone parameter to parseTimestamp() or findTimestamp(). Since parsers are where ingest-time transformations are defined, the correct engineering approach is to create or clone a custom parser for that log source and explicitly apply the needed timezone handling there. CrowdStrike’s custom parser docs explain that parsers are used to control how incoming events are transformed during ingest, and the timestamp parsing docs explain that timezone can be set directly in the parser logic.

Why the other options are incorrect:

B is not the documented parser-side solution. While changing the source may work operationally in some environments, CrowdStrike’s parsing guidance focuses on fixing time interpretation in the parser by using timezone or related timestamp parsing controls. C is incorrect because changing the timestamp field name does not solve timezone parsing. D is incorrect because dropping the source timestamp and relying on ingest time would lose the original event time, which is exactly what parsers are meant to preserve by converting source timestamps into @timestamp. CrowdStrike explicitly states that one of the most important jobs of a parser is assigning correct timestamps to events.

==========

CrowdStrike SIEM Connector and LogScale guidance states that JSON output preserves the raw nested JSON structure of incoming event data. This is the correct choice when a downstream system expects full nested event content instead of flattened key-value pairs. Syslog, CEF, and LEEF are transformation formats intended for compatibility with other log analysis tools and normalized ingestion workflows.

==========

The correct answer is A. All . Falcon Next-Gen SIEM is designed to unify first-party Falcon telemetry with third-party ingested data in a single investigation and search experience. When the query needs to include both Falcon Sensor data and third-party connector data, the correct data source selection is the one that includes both categories together, which is All . CrowdStrike describes Next-Gen SIEM as correlating native Falcon data with third-party sources to provide a unified security view.