CrowdStrike CCSA: CrowdStrike Certified SIEM Analyst (CCSA)

Last checked November 10, 2026 against the official CrowdStrike exam page.

1. Question 1Querying and Analytics

   A SOC analyst needs to find every failed logon event from one server during the last six hours. Which query approach is most efficient in a Next-Gen SIEM search?

   1. ASearch the full retention period and sort the results by timestamp in the table view
   2. BSet a six-hour time range, then filter on the server name and failed logon event type first
   3. CExport every logon event for the past month to a spreadsheet and filter the rows there
   4. DBuild a dashboard widget that refreshes every minute and covers every host in the whole environment
   Show answer and explanationHide answer

   Correct answer: B

   Narrowing the time range and applying field filters before any aggregation keeps the search small and fast. Searching the full retention period, exporting a month of data, or refreshing a widget across every host all process far more data than the question needs.

2. Question 2Detection Logic and Alert Analysis

   A detection fires on a nightly backup tool that touches the same files every run. The analyst confirms the tool, the service account and the schedule are all approved. How should the alert be classified?

   1. AA confirmed intrusion that requires immediate isolation of the backup server and its service account
   2. BA legitimate detection that proves the backup job has been compromised and must be reviewed by the SOC
   3. CA test event that can be deleted from the console without any notes because it has no impact
   4. DA false positive that should be documented and tuned, since the activity is approved and expected
   Show answer and explanationHide answer

   Correct answer: D

   Activity that is approved and expected is a false positive for this environment, and the detection should be documented and tuned. Treating it as an intrusion, deleting it without notes, or calling it proof of compromise ignores the confirmed context.

3. Question 3Incident Investigation

   An analyst finds a suspicious PowerShell process on a workstation, followed by a new service on the same host and then a remote logon to a file server. What is the best next step to understand the attack path?

   1. AOrder related events by timestamp across endpoint and identity sources to show the sequence
   2. BIsolate every host in the subnet before reviewing any individual event in detail
   3. CReview only the title of the first alert, since it usually summarizes the full attack path
   4. DSearch each data source separately and keep the results in separate notes without linking them
   Show answer and explanationHide answer

   Correct answer: A

   Putting related events in time order across sources shows how the activity moved from one host to the next. Reading only the alert title, isolating before understanding, or keeping unlinked notes each hides the sequence.

4. Question 4Reporting and Communication

   An analyst closes an investigation with case notes that say only 'reviewed, all good'. What is the main problem with this record?

   1. AThe notes cannot show what evidence was reviewed or why decisions were made, so the work cannot be audited
   2. BCase notes are only required when a breach is confirmed, so short notes are acceptable for every other case
   3. CThe case management database rejects any note that contains more than one sentence of text at a time
   4. DBrief notes make the case load faster in the console, which matters more than the content of the record
   Show answer and explanationHide answer

   Correct answer: A

   Case notes must record evidence, decisions and reasoning so that another analyst or an auditor can follow the work. The other options wrongly limit when notes matter or treat the record as a performance concern.

5. Question 5Querying and Analytics

   What does the pipe character (|) do in a CQL query?

   1. AIt marks the start of a comment that the query engine skips when it runs the search
   2. BIt acts as a wildcard that matches any single character inside a field value in the event
   3. CIt joins two separate saved searches into one result set without applying any filter
   4. DIt passes results from one stage into the next, so each step refines the data further
   Show answer and explanationHide answer

   Correct answer: D

   In CQL the pipe chains stages, so the output of one function becomes the input of the next. It is not a wildcard, does not merge saved searches, and does not start a comment.