CertArea
All CrowdStrike exams

Free CCSA practice test: 30 questions with answers

30 original questions for CrowdStrike Certified SIEM Analyst (CCSA), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions
Real exam
60 questions, 90 min

CCSA exam guide: topics, cost and format

All 30 CCSA questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Querying and Analytics (8 questions)

  1. Question 1

    A SOC analyst needs to find every failed logon event from one server during the last six hours. Which query approach is most efficient in a Next-Gen SIEM search?

    1. ASearch the full retention period and sort the results by timestamp in the table view
    2. BSet a six-hour time range, then filter on the server name and failed logon event type first
    3. CExport every logon event for the past month to a spreadsheet and filter the rows there
    4. DBuild a dashboard widget that refreshes every minute and covers every host in the whole environment
    Show answer and explanation
    Correct answer: B

    Narrowing the time range and applying field filters before any aggregation keeps the search small and fast. Searching the full retention period, exporting a month of data, or refreshing a widget across every host all process far more data than the question needs.

  2. Question 2

    What does the pipe character (|) do in a CQL query?

    1. AIt marks the start of a comment that the query engine skips when it runs the search
    2. BIt acts as a wildcard that matches any single character inside a field value in the event
    3. CIt joins two separate saved searches into one result set without applying any filter
    4. DIt passes results from one stage into the next, so each step refines the data further
    Show answer and explanation
    Correct answer: D

    In CQL the pipe chains stages, so the output of one function becomes the input of the next. It is not a wildcard, does not merge saved searches, and does not start a comment.

  3. Question 3

    Two analysts run the same CQL query but see different counts. One used last week as the time range and the other used last month. What explains the difference?

    1. AThe counts only include events inside each selected window, so a different window changes the totals
    2. BResults are cached for the first analyst, so the second analyst always sees fewer matches
    3. CThe time range only changes the color of chart bars and never the set of events that match
    4. DTime ranges apply only to saved dashboards, so ad-hoc searches always return every event ever stored in the environment
    Show answer and explanation
    Correct answer: A

    The time window decides which events are eligible to match, so the same logic over different windows gives different totals. The other options misstate how time ranges and result handling work in a search.

  4. Question 4

    What is the main benefit of the CrowdStrike Parsing Standard for an analyst who searches several log sources?

    1. AIt encrypts every event at rest so that only the analyst who originally wrote the query is able to read the data
    2. BIt replaces the need for time ranges by indexing all events permanently in memory for instant access
    3. CIt converts every event into an image file so that it can be attached to written reports easily
    4. DIt normalizes field names across different log sources so one query can be applied across them consistently
    Show answer and explanation
    Correct answer: D

    The CrowdStrike Parsing Standard maps fields from different sources onto a common naming scheme, which lets one query work across them. It does not handle encryption, remove time ranges, or create report images.

  5. Question 5

    Which two statements about saved queries are accurate? (Choose two.)

    1. AA saved query can be rerun later without retyping its filters and pipeline stages
    2. BRunning a saved query permanently removes the events that it matched from the data store
    3. CThe same saved query logic can be run again with a different time window
    4. DA saved query must be rewritten from scratch before its logic can be reused in a later investigation
    Show answer and explanation
    Correct answer: A, C

    A saved query keeps its filters and pipeline so it can be rerun, and the time window can change on each run. Running a query only reads matching events, and saved queries do not need to be rewritten before reuse.

  6. Question 6

    An analyst runs a query that returns zero results for a field they expected to see. Which is the most sensible first check?

    1. AAssume the data source has stopped ingesting, then open a support case before checking the query or the time range
    2. BDelete the query and rebuild it using a wildcard on every field in the event schema
    3. CConfirm the field name and value spelling match the data, and that the time range covers the events
    4. DIncrease the dashboard refresh rate so that the count updates faster when new data arrives
    Show answer and explanation
    Correct answer: C

    A zero count usually comes from a mismatched field name, value spelling or time window, so those should be checked first. Assuming an outage or rebuilding the query blindly skips the simple checks, and a faster refresh rate does not change what the query matches.

  7. Question 7

    A team wants the same set of charts to be ready for every analyst each morning without rebuilding them by hand. Which option best fits?

    1. AHave each analyst rebuild the charts from memory at the start of every shift to stay sharp
    2. BCreate a shared dashboard whose panels are built from saved queries that every analyst can open
    3. CExport each chart as a screenshot and paste it into a shared document that is updated every morning
    4. DTurn off the time range so the charts always show the same fixed numbers regardless of new data
    Show answer and explanation
    Correct answer: B

    A shared dashboard built from saved queries gives every analyst the same panels without manual rework. Rebuilding by memory, pasting static screenshots, or removing time ranges either wastes effort or produces stale, misleading numbers.

  8. Question 8

    An analyst found a suspicious file hash on one host and needs to know every other host that ran the same file. Which action best describes a pivot in this investigation?

    1. AUse the hash value from the first result as the filter in a new search across the other data sets
    2. BOpen each host's local event log manually and read it line by line until the file appears
    3. CCopy the first host name into a text document and rename the file on the affected laptop
    4. DTurn off all logging on the first host so that the hash can no longer be queried from the console later on
    Show answer and explanation
    Correct answer: A

    A pivot reuses a value from one result, such as the hash, as the filter for a new search of related data. Renaming files, reading logs by hand or disabling logging do not link the investigation to other hosts.

Detection Logic and Alert Analysis (8 questions)

  1. Question 9

    A detection fires on a nightly backup tool that touches the same files every run. The analyst confirms the tool, the service account and the schedule are all approved. How should the alert be classified?

    1. AA confirmed intrusion that requires immediate isolation of the backup server and its service account
    2. BA legitimate detection that proves the backup job has been compromised and must be reviewed by the SOC
    3. CA test event that can be deleted from the console without any notes because it has no impact
    4. DA false positive that should be documented and tuned, since the activity is approved and expected
    Show answer and explanation
    Correct answer: D

    Activity that is approved and expected is a false positive for this environment, and the detection should be documented and tuned. Treating it as an intrusion, deleting it without notes, or calling it proof of compromise ignores the confirmed context.

  2. Question 10

    What is the difference between a first-party detection and a third-party passthrough detection in Next-Gen SIEM?

    1. AThird-party passthrough detections are generated only by correlation rules that the SOC team writes and maintains themselves on a regular basis
    2. BBoth types are created by identical built-in rules and differ only in the color used to display them in the console
    3. CFirst-party detections come from CrowdStrike products; third-party passthrough detections are alerts forwarded from external tools
    4. DFirst-party detections are always rated lower in severity than any third-party alert that is ingested into the console from outside sources
    Show answer and explanation
    Correct answer: C

    First-party detections originate from CrowdStrike products, while passthrough detections carry alerts from external tools into the console. Correlation rules are a separate detection type, and origin does not set severity or display color.

  3. Question 11

    Which description best matches the role of a correlation rule in Next-Gen SIEM?

    1. AIt copies every raw event into a separate archive so that long-term compliance retention can be met easily
    2. BIt blocks network traffic automatically whenever a single event matches a keyword in the raw log file for the host
    3. CIt assigns each alert to an analyst based on the shift schedule, each person's workload and their assigned region
    4. DIt combines related events from one or more data sources and raises an alert when a pattern occurs across them
    Show answer and explanation
    Correct answer: D

    A correlation rule looks for a pattern across related events, possibly from several sources, and raises an alert when that pattern appears. Archiving, automatic blocking on a single keyword, and alert assignment are different functions.

  4. Question 12

    An analyst maps an alert to MITRE ATT&CK and sees a technique under the Persistence tactic. What does this suggest about the activity?

    1. AThe behavior is a stealthy data exfiltration step that moves files out of the network boundary
    2. BThe alert came from a third-party tool, so it has no tactic mapping and can safely be ignored
    3. CThe sensor could not read the process command line during the event, so the mapping is only a guess
    4. DThe behavior is associated with keeping access on a system across restarts or new logons
    Show answer and explanation
    Correct answer: D

    Persistence techniques are used to keep a foothold through restarts or new logons. Exfiltration, sensor visibility gaps and third-party origin do not describe what a Persistence mapping means.

  5. Question 13

    An alert shows high severity but low confidence. An analyst is deciding what to do next. Which action is most appropriate?

    1. AEscalate immediately because severity alone determines the priority of every alert that appears in the queue today
    2. BCheck the supporting evidence before escalating, because high severity with low confidence can still be a false positive
    3. CClose the alert without any review, since low confidence always means the activity is benign and needs no action
    4. DIgnore severity entirely and sort the queue only by the time at which each individual alert was originally created
    Show answer and explanation
    Correct answer: B

    Severity describes potential impact while confidence describes how sure the detection is, so the two should be read together. Escalating on severity alone, closing without review, or ignoring severity each skip the evidence check that the metadata calls for.

  6. Question 14

    Which two items are part of an alert's metadata that help an analyst triage it? (Choose two.)

    1. ASeverity and confidence values that indicate how urgent the alert is and how reliable the detection is
    2. BThe MITRE ATT&CK tactic and technique that the detection is mapped to
    3. CThe password policy version configured on the domain controller at the time of the event
    4. DThe percentage of the network bandwidth consumed by the host during the event window
    Show answer and explanation
    Correct answer: A, B

    Severity, confidence, tactic and technique describe the detection itself and guide triage. Domain password policy versions and bandwidth percentages are unrelated to the alert record and do not help classify it.

  7. Question 15

    A detection generates many alerts that the team considers noise. Which step should come first before changing the detection logic?

    1. ADisable the detection for all hosts so that the queue shrinks immediately and stays quiet
    2. BRaise the severity so the detection is reviewed sooner by the whole team and by management
    3. CReview several sample alerts to confirm the pattern is expected in the environment before tuning
    4. DDelete the detection and wait for a vendor update to restore it later in the year if needed
    Show answer and explanation
    Correct answer: C

    Sampling alerts shows whether the pattern is expected activity before any change is made, which keeps tuning justified. Disabling for all hosts, raising severity or deleting the detection change coverage without evidence.

  8. Question 16

    In MITRE ATT&CK, how does a tactic relate to a technique?

    1. AA tactic is the adversary's goal, and a technique is a specific method used to reach that goal
    2. BA technique is a broad goal, and a tactic is a single command that an attacker runs on a host
    3. CTactics and techniques are the same thing, and the terms are used interchangeably in every alert
    4. DA tactic is the name of the security product that generated the alert, and techniques are its version numbers
    Show answer and explanation
    Correct answer: A

    A tactic describes why an adversary acts, and a technique describes how they do it within that tactic. The other options swap the two terms or describe product metadata instead of the framework's structure.

Incident Investigation (7 questions)

  1. Question 17

    An analyst finds a suspicious PowerShell process on a workstation, followed by a new service on the same host and then a remote logon to a file server. What is the best next step to understand the attack path?

    1. AOrder related events by timestamp across endpoint and identity sources to show the sequence
    2. BIsolate every host in the subnet before reviewing any individual event in detail
    3. CReview only the title of the first alert, since it usually summarizes the full attack path
    4. DSearch each data source separately and keep the results in separate notes without linking them
    Show answer and explanation
    Correct answer: A

    Putting related events in time order across sources shows how the activity moved from one host to the next. Reading only the alert title, isolating before understanding, or keeping unlinked notes each hides the sequence.

  2. Question 18

    An analyst sees one account authenticate to 14 different servers within 20 minutes. None of those servers is normally used by that account, and there is no change record for the activity. What is the best interpretation?

    1. AA user has simply logged in from a new laptop, which is harmless and does not need any follow-up at all
    2. BA backup agent is running its nightly job across those servers, so the activity is expected and needs no action
    3. CThe pattern resembles lateral movement, so the analyst should check the account's role and the source host
    4. DThe logons are normal because all domain accounts are allowed to authenticate to every server by default
    Show answer and explanation
    Correct answer: C

    Rapid authentication to many hosts that the account never uses, with no change record, matches lateral movement and needs verification. The other interpretations ignore the lack of a business reason or misstate how authentication works.

  3. Question 19

    Which indicator most directly points to privilege escalation?

    1. AA user signing in from their usual workstation shortly after a routine password reset
    2. BAn application writing its log files to its own installation folder during normal operation
    3. CA standard user account added to a privileged group without an approved change request
    4. DA printer driver being updated through the normal patch schedule for the department
    Show answer and explanation
    Correct answer: C

    Gaining membership in a privileged group without approval is a direct sign that an account is gaining more rights than it should. The other activities are routine and do not change what an account can do.

  4. Question 20

    What is the main purpose of Falcon Fusion workflows during an investigation?

    1. AThey store the final written report for each closed incident in a read-only archive for auditors
    2. BThey convert CQL queries into SQL statements so that the results can be loaded into an external database
    3. CThey compress raw event data to reduce the storage used by the search index over time
    4. DThey automate repeated response steps, such as enrichment or notifications, when a defined trigger fires
    Show answer and explanation
    Correct answer: D

    Falcon Fusion is the workflow automation layer, so it runs repeatable response steps when a trigger matches. Archiving reports, compressing data and converting queries to SQL are not what Fusion workflows do.

  5. Question 21

    An analyst confirms malware on one laptop. Which step best assesses the scope of the incident?

    1. AReimage every server in the data center immediately, before collecting any evidence from the affected laptop
    2. BAssume the incident is contained because only one host has generated an alert so far in the console
    3. CCheck whether the same file hash, command line or account appears on other hosts in the same time window
    4. DClose the incident once the malware has been removed from the first laptop and the alert has cleared in the console
    Show answer and explanation
    Correct answer: C

    Searching for the same indicators on other hosts within the relevant window shows how far the activity reached. Assuming containment from one alert, reimaging without evidence, or closing after cleanup skips the scope check.

  6. Question 22

    Which statement about indicators of compromise and contextual data is most accurate?

    1. AA file hash match on its own proves that the affected system is compromised and needs rebuilding
    2. BContext such as asset owner, user role and recent change records helps decide whether a match is a real threat
    3. CAn IOC is only meaningful when it is a complete antivirus signature file with full vendor metadata
    4. DContextual data should be discarded as soon as an IOC has matched, because it can bias the analyst's view of the event
    Show answer and explanation
    Correct answer: B

    Context about the asset, the user and recent changes helps separate real threats from benign matches. A hash match alone is not proof of compromise, an IOC does not need to be a full signature file, and context should be kept rather than discarded.

  7. Question 23

    Which three findings would most strengthen the case that an attacker has moved laterally between hosts? (Choose three.)

    1. AA user logging into a laptop from their home network during normal business hours
    2. BA newly created service on a server that was used to run commands remotely on that server
    3. CA software update applied to a workstation through the department's normal patch schedule
    4. DOne account authenticating to several servers that it has no documented business reason to reach
    5. ERemote administration tooling launched from a jump host that does not appear in the change record
    Show answer and explanation
    Correct answer: B, D, E

    A new service used for remote command execution, one account reaching servers without a reason, and unapproved remote tooling from a jump host all point to movement between hosts. Normal logins and routine patching are expected activity and do not strengthen that case.

Reporting and Communication (7 questions)

  1. Question 24

    An analyst closes an investigation with case notes that say only 'reviewed, all good'. What is the main problem with this record?

    1. AThe notes cannot show what evidence was reviewed or why decisions were made, so the work cannot be audited
    2. BCase notes are only required when a breach is confirmed, so short notes are acceptable for every other case
    3. CThe case management database rejects any note that contains more than one sentence of text at a time
    4. DBrief notes make the case load faster in the console, which matters more than the content of the record
    Show answer and explanation
    Correct answer: A

    Case notes must record evidence, decisions and reasoning so that another analyst or an auditor can follow the work. The other options wrongly limit when notes matter or treat the record as a performance concern.

  2. Question 25

    Which element belongs in a well-written case record?

    1. AA timeline of key events, the evidence referenced, the decision taken and the owner of any follow-up action
    2. BA copy of the full vendor license agreement for the security tool that was used during the investigation
    3. CA screenshot of a dashboard panel that is unrelated to the alerts under investigation
    4. DThe analyst's personal opinions about the employees who were involved in the activity, written in as much detail as possible
    Show answer and explanation
    Correct answer: A

    A case record should show the sequence of events, the evidence, the decision and who owns the next step. Personal opinions, license agreements and unrelated screenshots do not support the investigation.

  3. Question 26

    An executive wants to see how many blocked connections occurred per country over the last week, all in one view. Which output best fits this need?

    1. AA raw list of every packet header captured on the network during the week, in the order it was captured
    2. BA bar chart of counts grouped by country for the selected time range
    3. CA free-text paragraph describing each connection in chronological order, with one sentence per event
    4. DA single unlabeled number representing the total bytes transferred across every host in the company network
    Show answer and explanation
    Correct answer: B

    A grouped count shown as a bar chart gives the executive a per-country comparison in one view. Raw packet lists, long narrative text and a single unlabeled total do not show the breakdown requested.

  4. Question 27

    Why do analysts summarize large event sets with aggregations before presenting them to leadership?

    1. AAggregations condense large volumes of events into counts and trends that show a pattern at a glance
    2. BAggregations encrypt the underlying event data before it is shared with people outside the team and the company
    3. CAggregations permanently delete outlier events so that the chart does not show false alarms
    4. DAggregations replace the need for timestamps by ordering the results alphabetically by host name instead
    Show answer and explanation
    Correct answer: A

    Aggregations turn large event volumes into counts and trends that are easy to read. Deleting outliers, encrypting data and dropping timestamps are not what aggregations do, and deleting outliers would hide real activity.

  5. Question 28

    A dashboard panel shows a sharp spike that the analyst suspects comes from an outage in one log source rather than an attack. What should the analyst write in the report?

    1. ANote the suspected cause, the evidence behind it, and flag the spike as still needing confirmation
    2. BRemove the panel from the dashboard so that it no longer raises questions from the rest of the team
    3. CHide the time range so the spike appears to be part of the normal baseline activity for the period
    4. DPresent the spike as a confirmed attack in the report so that leadership fully understands the level of risk
    Show answer and explanation
    Correct answer: A

    Stating the suspected cause, the supporting evidence and what still needs confirmation keeps the report honest and useful. Calling it a confirmed attack, hiding the panel or hiding the time range would misrepresent the data.

  6. Question 29

    Which two practices make a case-management update useful to the next analyst who picks up the work? (Choose two.)

    1. ARecording each decision together with the reason it was made and the evidence it relied on
    2. BWriting a summary that repeats the exact wording of the original alert title and nothing more
    3. CLinking related alerts, hosts and saved searches to the case so the work can be traced later
    4. DDeleting earlier notes once a newer conclusion is reached so that the record stays short
    Show answer and explanation
    Correct answer: A, C

    Recording decisions with their reasons and evidence, and linking related items to the case, let the next analyst follow the work. A repeated alert title adds nothing, and deleting earlier notes removes the history that makes the record useful.

  7. Question 30

    Which approach best presents a detection's trend over time to a non-technical audience?

    1. AA dump of the raw query text with no explanation of what the results mean for the business
    2. BA simple time-series chart with labeled axes and a short note on what changed and why it matters
    3. CA table of several hundred columns so that every field is visible on one screen at the same time
    4. DA set of unlabeled charts with colors chosen only for style, so that the audience can interpret them freely
    Show answer and explanation
    Correct answer: B

    A labeled time-series chart with a short plain-language note shows the trend and its significance without technical overload. Raw query text, very wide tables and unlabeled charts make the trend hard for the audience to read.