CCSE-204 試験問題を無料オンラインアクセス

Review the log event below:
{"ts": "2018/11/01 14:31:10", "server": "web01", "message": "Out of memory"} Which parsing function is correct to add a missing timezone field?

• A.parseJson() | parseTimestamp("yyyy/MM/dd HH:mm:ss", timezone="Europe/Paris", field=ts)
• B.parseJson() | parseTimestamp("dd/MMM/yyyy:HH:mm:ss Z", timezone="Europe/Paris", field=ts)
• C.kvParse() | findTimestamp(field=ts, timezone="Europe/London")
• D.kvParse() | findTimestamp(timezone="America/New_York")

What is true about first-party data from the Falcon platform and its integration into Next-Gen SIEM?

• A.First-party data requires a log collector installation
• B.It is quickly ingested to Next-Gen SIEM via a third-party integration
• C.It is instantly accessible within Next-Gen SIEM

A correlation rule is generating a high volume of detections. You have been asked to temporarily deactivate it so your team can investigate.
What will happen to previously generated detections while the rule is in a deactivated state?

• A.They will be immediately deleted from the console
• B.Their status will change to closed and tagged as false positives in the console
• C.They will not be impacted and will remain within the console
• D.Their status will change to closed and tagged as true positives in the console

Review the log sample below:

What type of parser should be used to extract fields and values from this log?

• A.Key-Value
• B.CSV
• C.XML
• D.JSON

What should you do with a field that is not CPS-compliant when adding it to a parser?

• A.Convert the field to ECS format
• B.Prefix the field with Vendor
• C.Leave the field unchanged
• D.Remove the field from the parser output