Analyze Alerts That Are Generated from Detection Rules ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   When an Elastic Security detection rule generates an alert, which field in the alert document typically contains the rule's unique identifier?

   • Aevent.id
   • Balert.id
   • Csignal.rule.id
   • Drule.name
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC analyst is triaging an alert for a potential data exfiltration. The alert shows a large outbound transfer from a server to an external IP. The analyst enriches the alert with threat intelligence and finds that the external IP is a known cloud storage service. What should the analyst do next?

   • AInvestigate the server's role and whether the transfer is consistent with normal business operations, such as a backup to cloud storage.
   • BTreat it as a true positive and immediately block the external IP.
   • CIgnore the alert because cloud storage services are commonly used and not malicious.
   • DEscalate the alert to the incident response team without further analysis.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the goal of the eradication phase in incident response?

   • ARemove the threat from the affected systems
   • BCollect evidence for legal proceedings
   • CRestore systems to normal operation
   • DNotify stakeholders of the incident
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC has a limited team and receives a high volume of alerts. The team needs to prioritize alerts effectively. Which approach best balances thoroughness and efficiency?

   • AInvestigate every alert manually to ensure no alert is missed, regardless of severity.
   • BAutomate the triage of low-severity alerts with predefined playbooks, and focus analyst effort on high-severity alerts that require human judgment.
   • CDisable all low-severity detection rules to reduce alert volume.
   • DPrioritize alerts based solely on the number of affected users, ignoring severity.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC analyst is triaging multiple alerts. Alert A is a medium-severity alert for a single failed login from an internal IP. Alert B is a high-severity alert for multiple failed logins from an external IP targeting a domain admin account. Alert C is a low-severity alert for a successful login from a known employee's account during off-hours. Given limited time, which alert should the analyst prioritize first?

   • AAlert C, because off-hours logins are always suspicious and should be investigated immediately.
   • BAlert B, because it targets a high-privilege account from an external source with multiple failures, indicating a possible brute-force attack.
   • CAll alerts equally, because every alert must be investigated thoroughly regardless of severity.
   • DAlert A, because it involves an internal IP that could indicate lateral movement.
   Reveal Solution Discussion Select an answer first