Analyze Alerts That Are Generated from Detection Rules ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 5)

Questions 21–23

1. 21foundation · easy

   Which factor is most important when prioritizing alerts during triage?

   • AThe timestamp of the alert
   • BThe number of alerts in the queue
   • CThe severity assigned by the detection rule
   • DThe analyst's familiarity with the rule
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst confirms a true positive alert: a workstation is infected with ransomware, and the encryption process is ongoing. The analyst has isolated the workstation from the network. What is the next appropriate response action?

   • ANotify the user that their files are encrypted and ask them to pay the ransom.
   • BReconnect the workstation to the network to continue monitoring the ransomware's behavior.
   • CRestore the workstation from the last known good backup immediately.
   • DEradicate the ransomware by removing the malicious files and cleaning the system, then restore from backup if needed.
   Reveal Solution Discussion Select an answer first
3. 23foundation · easy

   In a systematic alert triage workflow, what is the first step an analyst should take after an alert is triggered?

   • AValidate the alert's accuracy by reviewing the underlying events
   • BEscalate the alert to senior management
   • CUpdate the detection rule to prevent future alerts
   • DContain the affected system immediately
   Reveal Solution Discussion Select an answer first