Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Google Chronicle > Cribl User CCOE > Flashcards

Cribl User CCOE Flashcards

1
Q

Data without a particular format can be processed by Stream

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Cribl Stream is limited to ONLY processing JSON, CSV, Key-Value formats

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are numeric respresentations of data measured over intervals of time?

A

Metrics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Cribl Stream can process a wide variety of data and export it to RAW or JSON format.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Metrics are the smallest unit of data.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

____ are a type of data that provides Cribl Stream with inputs for learning about an IT environment.

A

Logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The observability lake does not replace existing observability and security solutions - it augments them.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Cribl Stream can work with a wide variety of agents.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

(Select all that apply) What are some common data tools?

A

Data Lakes and Object Storage, Agents, SIEM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The three V’s of data are Volume, Value, and Variety

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

In a distributed environment, the Leader Node is used to configure each Worker Node.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

It is best practice to install the Cribl application in the /opt directory

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Cribl Stream must be installed as a privileged user

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

It is best practice to create a Cribl user to install Cribl

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Cribl Stream is a Free download from the Crible website

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Port 9001 must be open in order to deploy Cribl Stream

A

False, Port 9000 is the correct port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What default port is used to deploy a distributed Cribl Stream environment?

A

Port 4200

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Crible Stream uses a different binary to install the workers?

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Cribl Stream supports the ability to use systemd or initd to start on boot

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Git is optional when installing Cribl Stream when in Distributed Mode.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Cribl Leader Node

A

Manages both Worker Nodes and Edge Nodes by sending configuration information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Cribl Stream

A

Uses Worker Nodes to process data. A Worker Group is a group of nodes with the same configuration.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Cribl Edge

A

Uses Edge Nodes to gather data. A fleet or sub fleet is a group Edge Nodes that are of the same type or collecting the same kind of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Cribl Stream: Sources

A

Stream supports both push and pull
Push-based: sources that send sata to Stream
Pull-based: Sources that fetches data from
Collectors: Ability to fetch data from local or remote sources on a schedule

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Crible Stream: Destinations

A

Cribl Stream supports Streaming and non-streaming destinations
Streaming: accepts events in real time/mini batches
Non-Streaming: accepts events in (large) groups or batches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Routing Traffic:
QuickConnect

A

Allows you to visually connect Stream Sources to output Destinations through simple drag-and-drop

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Routing Traffic:
Routes

A

Allows you to completely configure the data path through Stream by defining a series of filter expressions to determine how to process the event.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Routes

A

Direct data to Pipelines
Evaluate incoming events against filters
Each Route can be associated with only one Pipeline and one output
Evaluated in order
Routes default with “Final flag” set to Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Route strategies

A

Most-specific first or the most general first
General goal is to minimize the number of filters/Routes an event get evaluated against

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Pipeline

A

a list of Functions that process events.
Events always move in the direction that points outside of the system
Functions are evaluated in order: Top > Down
Different Pipeline “types” or position in the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Functions

A

Building blocks of Pipelines
Discrete processing on an event
Javascript
Work only on events that match their Filter condition
Final toggle:
No - Pass resulting events down
Yes - Short-circuit Functions below
Comments allow for added documentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Cribl Stream Packs

A

Pre-built configurations designed to simplify the deployment and use of Cribl’s Stream product
Includes Almost Everything - Configurations include everything between Sources and Destinations
Packs enable plug and play deployments for specific use cases
Cribl Packs Dispensary - packs respository to quickly locate and download Packs

a collection of pipelines and knowledge objects that are bundled together for easy deployment and redeployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Event

A

a collection of key-value pairs (fields)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is the benfit of using Cribl Members?

A

It simplifies the process of managing user permissions within the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What do you call sources that send data to Cribl Stream?

A

Push-based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What function do you use to extract timestamps?

A

Auto Timestamp

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is another type of source that enables administrators to fetch data from local or remote sources both on-demand or scheduled?

A

Collectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Where can you view Cribl Stream current throughput?

A

Monitoring Tab

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

You can find a regex library within Cribl Stream

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What collector types are currently supported in Cribl Stream?

A

All of the above:
FilesystemNFS
S3 Stores
Custom Scripts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Cribl Stream does not prescribe a particular schema, and can work with events in any shape, this is called schema-agnostic

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Cribl Stream allows you to write your own custom JavaScript code.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is the name of the instance that distributes configuration to a worker group?

A

Leader Node

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What are used in Routes to select a stream of the data flow, and in Functions to scope or narrow down the applicability of the Function?

A

Filters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What do you call sources that Cribl Stream fetches data from?

A

Pull-based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is a collection of worker nodes that share the same configuration?

A

Worker Group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

As with any incoming data stream on a compatible Source, Cribl Stream can use:

A

Default or custom event breaker definitions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What function do you use to find and replace text?

A

Mask

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What function does the Final flag serve?

A

By setting the Final Flag to yes, the route will consume the event and it will NOT proceed further

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

A Route can

A

be associated with multiple sources and a single destination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Users can only be assigned one acces level in Cribl Members

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

For non-streaming destinations, when any condition is met, staged files are moved to their destination

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What do live Datagens do?

A

Enable users to generate sample data to troubleshoot Routes, Pipelines, Functions, and general connectivity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Cribl Projects allow for assigning granular access to specific data sources and destinations

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Cribl Members will eventually replace the need for local users and roles within Cribl products

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Cribl Projects are used to group users with similar roles

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Index-based searching

A

Data that needs to be collected, structured, and formatted in such a way that allows these tools to quickly find answers

58
Q

Search in Place

A

Does not require data to be pre-indexed; do not need to know in advanced about mapping the right terms and data

59
Q

Federated Search

A

Identify and correlate data from different sources, determine its value and then perform a deeper analysis

60
Q

Cribl Search required data to be indexed before searching

A

False

61
Q

Cribl Searh can only search cloud-based storage

A

False

62
Q

Which of the following statements is NOT true about Cribl Search?

A

It required pre-indexing of data before searching

These statements are TRUE:
It allows searching data at rest
It provides customizable dashboards for data visualization
It uses a familiar and easy-to-understand query language named Kusto

63
Q

Cribl Search is only available as a cloud-based service

A

True

64
Q

What query language is Cribl Search based on?

A

KQL

65
Q

Cribl Stream Packs

A

Pre-built configurations of Routes, Pipelines, Functions, Sample data files, Knowledge objects, etc. everything between Sources and Destinations
Packs enable plug & play simplicity
Access to a collection of Cribl and 3rd party created packs covering numerous use cases
Cribl Packs Dispensary - packs repository to quickly locate and download Packs

66
Q

Packs target users in

A

Medium/Large deployments sharing configurations and content across multiple worker groups

67
Q

In a distributed deployment, Packs are distributed to the worker group level

A

True

68
Q

Packs can…

A

Enable plug & play deployments for specific use cases
Improve time to value by reducing hurdles and providing Cribl Stream users with out of the box pipelines
Target users in medium/large deployments sharing configurations and contennt across multiple worker groups

69
Q

Packs can be imported using which of the following ways?

A

Import from a file
Import from a URL
Import from Git
Import from https://packs.cribl.io

70
Q

Users are allowed to create Packs and can share them with the community, if applicable

A

True

71
Q

What are pre-built configuration blocks designed to simplify the deployment and use of Cribl Stream?

A

Packs

72
Q

Cribl Stream only supports S3 as a long term storage object

A

False

73
Q

Once Replay is configured, how can a collector be controlled?

A

Scheduled, manual runs, or API calls

74
Q

When setting up and using Replay in Cribl Stream, where should you create a new destination?

A

Worker group config

75
Q

Cribl Stream Replay is compatible with “deep-freeze” storage that has long retrieval times

A

False

76
Q

Cribl recommends using JSON as the write out format

A

True

77
Q

Cribl Stream Replay allows you to write data out in either of two formats:

A

JSON or raw

78
Q

Please select all the reasons you could use Cribl Stream Replay

A

All of the below:
Ingest data into a new analytics platform
Ingest data to review a security issue
Ingest data from a company merger or acquisition

79
Q

Cribl Stream Replay allows you to store data in long term storage and then “replay” it for re-delivery to another tool

A

True

80
Q

Cribl Stream Replay can only be used to ingest data that has already been ingested

A

False

81
Q

Cribl recommends using Raw as the write out format

A

False

82
Q

What are Event Breaker Rules?

A

Rulesets used to break incoming streams from specific sources into individual events

83
Q

the Knowledge Tab allows you to see the current data throughput

A

False

84
Q

Global Variables are useful JavaScript expressions that can be leveraged by pipelines/functions to provide a service

A

True

85
Q

What are Parsers used to accomplish?

A

Common formats used to extract or re-format data

86
Q

Reusable JavaScript expressions are called?

A

Global Variables

87
Q

Cribl Stream allows you to create lookups in order to enrich incoming data

A

True

88
Q

Where would you look if you were trying to find common regex patterns for let’s say credit card formats?

A

Knowledge Tab

89
Q

The Cribl Stream Regex Knowledge Object provides the following Regexs by default

A

Social Security
Credit Card
MAC Address

90
Q

Cribl Stream provides some default Grok Patterns

A

True

91
Q

What is the Regexes Knowledge Object used for?

A

A set of common regex patterns (SSN, CC formats, etc)

92
Q

Select all regex shorthand character classes

A

\w or \W
\d or \D
\s or \S

93
Q

In regex, using a hyphen inside a character class

A

specifies a range of characters

94
Q

What function does the dollar sign $ serve in regex?

A

End of a string

95
Q

Correctly identify all regex quantifiers

A

a a+ a?
a{1,3}
ab|cd
All of the above

96
Q

Non-capturing groups take fewer CPU cycles and memory

A

True

97
Q

How can you group a specific part of a regular expression

A

By placing part of a regular expression inside round brackets or parentheses

98
Q

You can use regex to

A

Identify patterns in logs
Extract patterns in logs
replace patterns in logs
mask patterns in logs
all of the above

99
Q

You can use special character sequences to put non-printable characters in your regular expression

A

True

100
Q

In regex, “cat” does not match “Cat”

A

Always true unless you tell regex engine to ignore the differences in case

101
Q

Regex is short for

A

Regular expression

102
Q

What are the ways you can contact Cribl Support?

A

Email, Community Slack, Support Portal

103
Q

Cribl Support is available to everyone

A

False

104
Q

You can get support from the Cribl community through Slack using https://cribl-community.slack.com

A

True

105
Q

How does a Standard user become the Administrator for a customer account in the support portal?

A

Assigned by Cribl support

106
Q

What is required to access the Cribl Support Portal?

A

Cloud Account and email invitation

107
Q

What additional rights does the support portal account administrator have?

A

View all customer cases
Edit case information
Invite other users to the support portal
All of the above

108
Q

How many users can be assigned to a customers support account?

A

4

109
Q

What are some of the ways you can contact Cribl Support?

A

Email, Cribl community Slack, Support Portal

110
Q

what are numeric representations of data measured over intervals of time?

A
111
Q

Cribl Stream is limited to ONLY processing JSON, CSV, and Key-Value formats

A

False

112
Q

Metrics are the smallest unit of observability

A

False, Events is the right answer

113
Q

In a distributed environment, it is recommended to log into each Worker Node to configure it.

A

False

114
Q

How long does a typical Cribl Stream install take?

A

Wrong answers: 60 minutes

115
Q

What is the only preconfigured output in Cribl Stream?

A

DevNull

116
Q

What does the final toggle do when set to NO?

A

Passing resulting event down

117
Q

The basic interface concepts the users works with in Cribl Edge are:

A

Routes, Sources, Pipelines, Functions

118
Q

Which deployment instance is ideal for test, dev, QA, and evaluation purposes?

A

Single instance deployment

119
Q

What are sources that fetch data from Cribl Stream called?

A

Wrong answer: Fetch based

120
Q

What function does the user use to extract fields?

A

Parser

121
Q

An event is defined as a collection of key-value pairs?

A

True

122
Q

If a destination is unreachable, what provides durability by writing data to disk for the duration of the outage in Cribl?

A

Persistent Queuing

123
Q

as with any incoming data stream on a compatible Source, Cribl Stream can use:

A

Default of custom event breaker definitions

124
Q

The user must be using Cribl Stream to use Cribl Edge

A

False

125
Q

What can a route be associated with?

A

Multiple sources and a single destination

126
Q

What is processing that is based on discrete data entities commonly known as ?

A

Events

127
Q

What are meta-destinations that allow for rule-based (real) destinations selection in Cribl?

A

Output Routers

128
Q

What is a destination type that accepts events in (large) groups or batches?

A

Non-streaming destinations

129
Q

Internal fields are used outside of Cribl Stream and can be passed to destinations.

A

False

130
Q

what function does the user use to find and replace text?

A

Mask

131
Q

In regex, what does using a hyphen inside a character class do?

A

Specifies a range of characters

132
Q

All Packs that are created in Cribl will automatically be shared with the community.

A

False

133
Q

In a single instance deployment, packs are at the Worker Group level?

A

False

134
Q

Without Packs, an administrator must do all Pipeline configuration manually?

A

True

135
Q

Once Cribl Replay is configured, how can a collector be controlled?

A

Scheduling, manual runs, or API calls

136
Q

What are typical examples of use cases for using lookups in Cribl?

A

Wrong answrs: defining…

137
Q

Cribl Stream provides some default Grok Patterns

A

True

138
Q

What are Parsers used to accomplish?

A

Common formats used to extract or re-format data

139
Q
A
140
Q
A

Google Chronicle (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions