CrowdStrike Certified SIEM Engineer Sample Questions:

1. What is the correct mode to enroll LogCollector into Fleet Management with configuration of the log sources stored and managed centrally in Next-Gen SIEM?

A) Full
B) localConfig
C) Central
D) Complete

2. Which default role will maintain least privilege and allow for creation and management of parsers?

A) NG SIEM Analyst - Read Only
B) NG SIEM Analyst
C) NG SIEM Security Lead
D) NG SIEM Administrator

3. You have been tasked with parsing the following space-delimited log:
2025-06-03 12:13:07 johndoe 192.168.5.15 login
The log source data is guaranteed to always be in the same order.
Which function can parse this log?

A) parseCEF()
B) parseCsv()
C) parseJson()
D) parseFixedWidth()

4. What are the four required CPS-compliant Event parser tags?

A) event.category
event.dataset
event.kind
event.outcome
B) event.dataset
event.kind
event.module
event.outcome
C) event.category
event.kind
event.module
event.outcome

5. You find a Falcon Log Collector instance on a Linux system that is not connected to Fleet Management.
What command would you use to enroll the Falcon Log Collector?

A) "C:\Program Files (x86)\CrowdStrike\Humio Log Collector\humio-log-collector.exe" enroll < TOKEN
>
B) sudo humio-log-collector --token < TOKEN > enroll
C) sudo logscale-collector enroll < TOKEN >
D) sudo humio-log-collector enroll < TOKEN >

Solutions: