An analyst is building a dashboard to monitor for lateral movement. They want to see failed logons, successful logons, and process creation events on multiple hosts. Which layout is most effective for this monitoring use case?

A single table with all events, sorted by timestamp.

A single line chart of total events over time, without host breakdown.

A map showing geographic locations of all events.

Separate panels for failed logons, successful logons, and process creation, each with a host breakdown.

An analyst notices a spike in failed logins from a specific IP address, followed by a successful login from the same IP. What does correlating these events in a dashboard help the analyst reveal?

The total number of failed logins

The geographic location of the IP address

A potential brute-force attack followed by successful compromise

The time of the first failed login

ElasticCertified SIEM Analyst

Domain 5Objective 1

Construct Dashboards for Security Use Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 3)

Part of the Dashboards domain, which makes up ~11% of our current practice bank.

22questions here

5free pages

8concepts

Questions 11–15

11foundation · easy
A security analyst is viewing a dashboard and wants to see the details of a specific alert that appears in a visualization. Which interactive feature would allow the analyst to click on the alert and see its full details?
Select an answer first
12foundation · easy
An analyst wants to allow users of a security dashboard to dynamically change the time period being displayed without editing the dashboard. Which interactive feature should be included?
Select an answer first
13application · medium
An analyst is building a dashboard to monitor for lateral movement. They want to see failed logons, successful logons, and process creation events on multiple hosts. Which layout is most effective for this monitoring use case?
Select an answer first
14foundation · easy
Which visualization type is most appropriate for showing the trend of security event counts over time?
Select an answer first
15foundation · easy
An analyst notices a spike in failed logins from a specific IP address, followed by a successful login from the same IP. What does correlating these events in a dashboard help the analyst reveal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.

Construct Dashboards for Security Use Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 3)

Questions 11–15

A security analyst is viewing a dashboard and wants to see the details of a specific alert that appears in a visualization. Which interactive feature would allow the analyst to click on the alert and see its full details?

An analyst wants to allow users of a security dashboard to dynamically change the time period being displayed without editing the dashboard. Which interactive feature should be included?

An analyst is building a dashboard to monitor for lateral movement. They want to see failed logons, successful logons, and process creation events on multiple hosts. Which layout is most effective for this monitoring use case?

Which visualization type is most appropriate for showing the trend of security event counts over time?

An analyst notices a spike in failed logins from a specific IP address, followed by a successful login from the same IP. What does correlating these events in a dashboard help the analyst reveal?

Keep studying — Dashboards