An analyst is building a dashboard that includes a terms aggregation on source.ip with a size of 10,000 to show all source IPs. The dashboard becomes very slow and times out. The analyst needs to maintain the ability to see all source IPs but must improve performance. Which approach should the analyst take?

Use a cardinality aggregation on source.ip

Reduce the size of the terms aggregation to 100

Increase the timeout setting on the Elasticsearch cluster

Replace the terms aggregation with a composite aggregation and paginate through the results

A SOC manager wants a single dashboard panel that shows, side by side, the count of malware detection events and the count of phishing detection events over the last 7 days. The analyst decides to use Kibana Lens. Which approach should the analyst take?

Create two separate date histogram visualizations, one for malware and one for phishing, and place them on the dashboard

Create a cardinality aggregation on event.category with a filter for malware and phishing

Create a terms aggregation on event.category and filter the visualization to only show malware and phishing

Create a filters aggregation with one filter for event.category: malware and another for event.category: phishing, then use a bar chart

A security engineer wants to understand the distribution of DNS response times to determine a baseline for anomaly detection. The engineer needs to know the 50th, 95th, and 99th percentile response times for all DNS queries in the last 24 hours. Which visualization configuration should be used?

A date histogram on @timestamp with a metric of average on dns.response_time, displayed as a line chart

A percentile aggregation on dns.response_time with percents [50, 95, 99], displayed as a data table

A terms aggregation on dns.response_time, displayed as a pie chart

An average aggregation on dns.response_time, displayed as a metric visualization

An analyst has created a useful bar chart in Kibana Lens showing failed logins by user. The analyst wants to add this chart to a security dashboard so other team members can view it. What is the correct sequence of actions?

Save the visualization from Lens, then add it to the dashboard from the dashboard editor

Take a screenshot of the chart and attach it to the dashboard

Export the visualization as a CSV file and upload it to the dashboard

Copy the Elasticsearch query from Lens and paste it into the dashboard

ElasticCertified SIEM Analyst

Domain 4Objective 1

Create Aggregation-Based Visualizations for Security Use Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 2)

Part of the Visualizations domain, which makes up ~13% of our current practice bank.

34questions here

7free pages

15concepts

Questions 6–10

6expert · hard
An analyst is building a dashboard that includes a terms aggregation on source.ip with a size of 10,000 to show all source IPs. The dashboard becomes very slow and times out. The analyst needs to maintain the ability to see all source IPs but must improve performance. Which approach should the analyst take?
Select an answer first
7application · medium
A SOC manager wants a single dashboard panel that shows, side by side, the count of malware detection events and the count of phishing detection events over the last 7 days. The analyst decides to use Kibana Lens. Which approach should the analyst take?
Select an answer first
8application · medium
A security engineer wants to understand the distribution of DNS response times to determine a baseline for anomaly detection. The engineer needs to know the 50th, 95th, and 99th percentile response times for all DNS queries in the last 24 hours. Which visualization configuration should be used?
Select an answer first
9foundation · easy
Which aggregation type is used to analyze the distribution of a metric, such as finding the 95th percentile of response times?
Select an answer first
10application · medium
An analyst has created a useful bar chart in Kibana Lens showing failed logins by user. The analyst wants to add this chart to a security dashboard so other team members can view it. What is the correct sequence of actions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.

Create Aggregation-Based Visualizations for Security Use Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 2)

Questions 6–10

A SOC manager wants a single dashboard panel that shows, side by side, the count of malware detection events and the count of phishing detection events over the last 7 days. The analyst decides to use Kibana Lens. Which approach should the analyst take?

A security engineer wants to understand the distribution of DNS response times to determine a baseline for anomaly detection. The engineer needs to know the 50th, 95th, and 99th percentile response times for all DNS queries in the last 24 hours. Which visualization configuration should be used?

Which aggregation type is used to analyze the distribution of a metric, such as finding the 95th percentile of response times?

An analyst has created a useful bar chart in Kibana Lens showing failed logins by user. The analyst wants to add this chart to a security dashboard so other team members can view it. What is the correct sequence of actions?

Keep studying — Visualizations