Construct Dashboards for Security Use Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A compliance team needs a dashboard to demonstrate that user access reviews are being performed. They have HR data in 'hr-*', Active Directory logs in 'ad-*', and access review records in 'reviews-*'. Which data source is most relevant for this compliance use case?

   • AHR data to show employee status.
   • BActive Directory logs to show user account activity.
   • CAll three data sources combined in a single visualization.
   • DAccess review records to show when reviews were completed and by whom.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A security team wants to collaborate on a dashboard and allow multiple analysts to view and interact with it. What is the most effective way to share the dashboard within the team?

   • AExport the dashboard as a PDF and share it via email
   • BCopy the dashboard JSON and paste it into a shared document
   • CTake a screenshot and post it in a team chat
   • DShare the dashboard link with the team members who have Kibana access
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A dashboard shows a spike in outbound network traffic from a server at the same time that a new process was created on that server. What does correlating these events help the analyst identify?

   • AThe server's IP address
   • BThe server's operating system version
   • CThe number of users logged into the server
   • DA potential data exfiltration attempt
   Reveal Solution Discussion Select an answer first
5. 4application · hard

   A security analyst wants to correlate VPN login events with subsequent unusual internal resource access to detect potential account compromise. They have VPN logs in 'vpn-*' and internal access logs in 'access-*'. What is the most effective way to build this correlation in a dashboard?

   • AUse a single visualization that queries both indices and joins on the username field.
   • BCreate a single visualization using a query that searches both indices and uses a scripted field to combine data.
   • CUse a single index pattern that includes both 'vpn-*' and 'access-*', then create a visualization that filters on VPN login events and internal access events, using the username field to correlate.
   • DCreate two separate visualizations, one for VPN logins and one for internal access, and place them side by side with a shared time range.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A security analyst wants to display the top 10 source IPs that have generated the most security alerts. Which visualization type is best suited for this?

   • ALine chart
   • BBar chart
   • CGauge
   • DMap
   Reveal Solution Discussion Select an answer first