CCSE-204 試験問題を無料オンラインアクセス

You want a consistent view of events from various data sources.
Which ECS field type should you normalize?

• A.Base Fields
• B.Detection Fields
• C.Extended Fields
• D.Core Fields

Which three System alerts are enabled by default in Next-Gen SIEM for third-party connectors?

• A.Alert if connector receives no data in 24 hours
  Alert if daily data ingestion limit exceeded
  Alert if monthly data ingestion limit is exceeded
• B.Alert if connector is disconnected
  Alert if daily data ingestion limit exceeded
  Alert if monthly data ingestion limit is exceeded
• C.Alert if daily data ingestion limit exceeded
  Alert if monthly data ingestion limit is exceeded
  Resolve alerts within 30 days
• D.Alert if connector receives no data in 24 hours
  Alert if connector is disconnected
  Resolve alerts within 30 days

You want a Next-Gen SIEM dashboard to update automatically when new data is available.
Which action would you take?

• A.Toggle the "Live" button to on
• B.Change the "Start Time" interval to 1 hour
• C.Change the "Relative Time Range" interval to 1 millisecond ago
• D.Change the "Fixed Time Range" to the current date

You notice a larger than expected ingest delay from one of your high-volume streaming log collectors.
Which setting should you increase on the log collector to improve performance?

• A.Default memory queue size
• B.Available source throughput
• C.Number of concurrent requests a sink is using
• D.Amount of available disk space

You are reviewing a lookup file to determine whether an event was successfully parsed during ingestion.
Which metadata field indicates the event's parsing status?

• A.@rawstring
• B.@error_msg
• C.@event_parsed
• D.@ingesttimestamp