A security analyst needs a dashboard panel showing the top 10 destination ports targeted by inbound traffic over the last 24 hours, ranked by event count. The analyst opens Kibana Lens and selects the appropriate visualization. Which configuration should the analyst use?

Date histogram on @timestamp with an interval of 1 hour, displayed as a line chart

Cardinality aggregation on destination.port, displayed as a metric visualization

Filters aggregation with a query for each common port (22, 80, 443, 3389), displayed as a pie chart

Terms aggregation on destination.port, sorted by count descending, with size set to 10, displayed as a horizontal bar chart

ElasticCertified SIEM Analyst

Domain 4Objective 1

Create Aggregation-Based Visualizations for Security Use Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 4)

Part of the Visualizations domain, which makes up ~13% of our current practice bank.

34questions here

7free pages

15concepts

Questions 16–20

16foundation · medium
When building a terms aggregation in Kibana to display the top security threats, which parameter directly controls the order in which the buckets are returned?
Select an answer first
17foundation · easy
Which aggregation type allows you to create buckets that contain only documents matching a specific query condition, such as all events with `event.category: authentication`?
Select an answer first
18foundation · easy
Where can a saved visualization be added so that multiple visualizations can be viewed together?
Select an answer first
19foundation · easy
Which aggregation is designed to paginate through many buckets when grouping by multiple fields, such as `source.ip` and `destination.port`?
Select an answer first
20application · medium
A security analyst needs a dashboard panel showing the top 10 destination ports targeted by inbound traffic over the last 24 hours, ranked by event count. The analyst opens Kibana Lens and selects the appropriate visualization. Which configuration should the analyst use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.

Create Aggregation-Based Visualizations for Security Use Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 4)

Questions 16–20

When building a terms aggregation in Kibana to display the top security threats, which parameter directly controls the order in which the buckets are returned?

Which aggregation type allows you to create buckets that contain only documents matching a specific query condition, such as all events with `event.category: authentication`?

Where can a saved visualization be added so that multiple visualizations can be viewed together?

Which aggregation is designed to paginate through many buckets when grouping by multiple fields, such as `source.ip` and `destination.port`?

A security analyst needs a dashboard panel showing the top 10 destination ports targeted by inbound traffic over the last 24 hours, ranked by event count. The analyst opens Kibana Lens and selects the appropriate visualization. Which configuration should the analyst use?

Keep studying — Visualizations