Which response action is most appropriate when an alert confirms an active malware infection on a critical server?

Ignore the alert and monitor for further activity

Isolate the server from the network

Reboot the server to clear the infection

To validate an alert generated by a detection rule, an analyst should examine which of the following?

The rule's last modification date

The underlying events that triggered the rule

The rule's MITRE ATT&CK technique mapping

An alert from a detection rule indicates that a user downloaded a suspicious file from an external URL. The analyst wants to confirm the alert by correlating it with the underlying events. Which data source should the analyst examine first?

The firewall logs to check if the external IP was blocked.

The authentication logs to verify the user's identity.

The web proxy logs to verify the URL and the file download event.

The endpoint detection and response (EDR) logs to see if the file executed.

A detection rule generates an alert with `event.category: file` and `event.action: modification`. The alert includes `file.path`, `file.hash`, and `process.name`. The analyst needs to determine if the file modification is malicious. Which combination of fields provides the most critical evidence?

`process.name` and `event.action`

`file.path` and `event.category`

ElasticCertified SIEM Analyst

Domain 6Objective 4

Analyze Alerts That Are Generated from Detection Rules ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 2)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

23questions here

5free pages

7concepts

Questions 6–10

6foundation · easy
Which response action is most appropriate when an alert confirms an active malware infection on a critical server?
Select an answer first
7foundation · easy
To validate an alert generated by a detection rule, an analyst should examine which of the following?
Select an answer first
8application · medium
An analyst is reviewing an alert from a detection rule. The alert's `event.category` is `network`, `event.action` is `connection`, and `destination.ip` is a known malicious IP. The analyst wants to verify if the connection was successful. Which field should the analyst examine?
Select an answer first
9application · medium
An alert from a detection rule indicates that a user downloaded a suspicious file from an external URL. The analyst wants to confirm the alert by correlating it with the underlying events. Which data source should the analyst examine first?
Select an answer first
10expert · hard
A detection rule generates an alert with `event.category: file` and `event.action: modification`. The alert includes `file.path`, `file.hash`, and `process.name`. The analyst needs to determine if the file modification is malicious. Which combination of fields provides the most critical evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.