Construct Dashboards for Security Use Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 5)

Questions 21–22

1. 21application · medium

   A SOC team wants to visualize the number of failed login attempts per user over the last 24 hours to identify potential brute-force attacks. They have authentication logs in the 'auth-*' index. Which visualization configuration is most appropriate?

   • AA pie chart of successful logins by user, filtered to the last 24 hours.
   • BA data table of raw logs, sorted by timestamp, with no aggregation.
   • CA line chart of all login events over time, without filtering by outcome.
   • DA bar chart of failed login attempts by user, filtered to the last 24 hours and event.outcome: failure.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC analyst is using a dashboard to investigate a phishing campaign. They want to click on a specific sender in a visualization and see all emails from that sender in a detailed table below. Which interactive feature should they configure?

   • ASet a dashboard-level time range filter.
   • BAdd a URL drilldown to the sender visualization that opens an external email gateway.
   • CEnable cross-visualization filtering by setting the sender field as a filter on the visualization.
   • DUse a saved search instead of a visualization for the sender list.
   Reveal Solution Discussion Select an answer first