Which command helps visualize in real time whether sources and sinks are working properly in the Log Collector?
Answer(s): B
The logscale-collector monitor command provides a real-time view of the Log Collector's operation, showing the status of sources and sinks to help ensure data is being ingested and processed correctly.
When deploying the Falcon Log Collector using the commands in the CrowdStrike Fleet Management interface, what is the correct service name?
Answer(s): C
The Falcon Log Collector service is named logscale-collector, which is used in installation, enrollment, and management commands when deploying via the CrowdStrike Fleet Management interface.
You need to provide a colleague the appropriate role to allow for configuration of connectors and creation ofSOAR automations in Next-Gen SIEM.Which role will provide these permissions while also maintaining least privilege?
Answer(s): A
The NG SIEM Security Lead role grants permissions to configure connectors and create SOAR automations while adhering to the principle of least privilege, avoiding unnecessary full administrative access.
You notice that the format of incoming logs suddenly changes from JSON format to key-value pairs during log collection.What action would you take to parse the data correctly?
When log formats vary, a multi-source configuration allows assigning the appropriate parser (e.g., JSON, key- value) to each data source, ensuring correct extraction and processing of all incoming logs.
You notice a larger than expected ingest delay from one of your high-volume streaming log collectors.Which setting should you increase on the log collector to improve performance?
Answer(s): D
Increasing the memory queue size allows the log collector to buffer more events in memory before processing or forwarding, reducing ingest delays for high-volume streams and improving overall performance.
Post your Comments and Discuss CrowdStrike CCSE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CCSE content, but please register or login to continue.