Exam CCSE-204 Topic 1 Question 7 Discussion

Actual exam question for CrowdStrike's CCSE-204 exam
Question #: 7
Topic #: 1
A parser needs to preserve the original third-party field name and also map it to an ECS-compatible field.
What is the best approach?

Suggested Answer: C Vote an answer

A CPS-compliant approach keeps the original Vendor field while also assigning the value to a normalized ECS field. This preserves source fidelity and enables standardized search and detections. Renaming away the original field loses source context, and storing only in @rawstring prevents structured analysis.

by Bertram at Jun 28, 2026, 08:38 PM

Limited Time Offer

15%

Off

Get Premium CCSE-204 Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10