CCSE practice questions 11–14

1. Question 11 · 14 in bank

   Which two tags are compliant with the CrowdStrike Parsing Standard (CPS)?

   • A#event.type and #event.kind
   • B#vendor.name and #event.type
   • C#observer.type and #event.kind
   • D#observer.type and #vendor.name

   Show answer

   Answer: A

   Next question

2. Question 12 · 14 in bank

   An event has the following fields:

   

   Which CQL query will output the frequency of a unique set of ComputerName, UserName, CommandLine?

   • A#event_simpleName = ProcessRollup2 FileName = ssh.exe CommandLine = /\s-R\s.+\s-p/ | table([ComputerName, UserName, CommandLine]) | count()
   • B#event_simpleName = ProcessRollup2 | FileName = ssh.exe | CommandLine = /\s-R\s.+\s-p/ | table([ComputerName, UserName, CommandLine], function=count())
   • C#event_simpleName = ProcessRollup2 | FileName = ssh.exe | CommandLine = /\s-R\s.+\s-p/ | groupBy([ComputerName, UserName, CommandLine], function=count())
   • D#event_simpleName = ProcessRollup2 FileName = ssh.exe CommandLine = /\s-R\s.+\s-p/ | groupBy([ComputerName, UserName, CommandLine])

   Show answer

   Answer: C

   Next question

3. Question 13 · 14 in bank

   You need to import a pre-built workflow into Fusion SOAR to automate a part of your incident response process. Which file format would you use?

   • A.CPP
   • B.JSON
   • C.PY
   • D.YAML

   Show answer

   Answer: D

   Next question

4. Question 14 · 14 in bank

   What are the four required CPS-compliant Event parser tags?

   • Aevent.category event.kind event.module event.outcome
   • Bevent.category event.dataset event.kind event.outcome
   • Cevent.dataset event.kind event.module event.outcome

   Show answer

   Answer: B

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCSE practice, question 11. 14 questions available.