An analyst is investigating an alert for a suspicious process execution on a server. The alert lacks information about the process's parent process and the user who launched it. Which enrichment would provide the most valuable context?

Enrich with the process's parent process and the user account from the endpoint data.

Enrich with the server's operating system version.

Enrich with the server's public IP address.

Enrich with the server's location in the data center.

When communicating alert findings to non-technical stakeholders, what is the most effective approach?

Avoid sharing any details to prevent confusion

Summarize the impact and recommended actions in business terms

Explain the exact rule logic and query syntax

Provide the raw event logs for review

What is the purpose of enriching an alert with threat intelligence data?

To automatically resolve the alert

To delete the alert from the system

To provide additional context about the indicators involved

An analyst is investigating an alert for a suspicious PowerShell command executed on a workstation. The alert lacks context about the user and the machine. Which enrichment step would provide the most useful context for this alert?

Search the internet for the exact PowerShell command to see if it is publicly documented as malicious.

Look up the user's role and department in the HR system, and check the machine's asset inventory for its business unit.

Check the firewall logs to see if the workstation communicated with any external IPs.

Review the workstation's recent patch history to see if it is up to date.

Why is documenting alert analysis findings important?

It deletes the alert from the system

It increases the alert's severity

It automatically resolves the alert

It provides a record for future reference and legal purposes

ElasticCertified SIEM Analyst

Domain 6Objective 4

Analyze Alerts That Are Generated from Detection Rules ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 1)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

23questions here

5free pages

7concepts

Questions 1–5

1application · medium
An analyst is investigating an alert for a suspicious process execution on a server. The alert lacks information about the process's parent process and the user who launched it. Which enrichment would provide the most valuable context?
Select an answer first
2foundation · easy
When communicating alert findings to non-technical stakeholders, what is the most effective approach?
Select an answer first
3foundation · easy
What is the purpose of enriching an alert with threat intelligence data?
Select an answer first
4application · medium
An analyst is investigating an alert for a suspicious PowerShell command executed on a workstation. The alert lacks context about the user and the machine. Which enrichment step would provide the most useful context for this alert?
Select an answer first
5foundation · easy
Why is documenting alert analysis findings important?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.