Create Aggregation-Based Visualizations for Security Use Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An analyst wants to compare the number of events from internal IPs versus external IPs over the last 24 hours. The analyst has a field called source.ip and a list of internal IP ranges. Which configuration should be used?

   • AA terms aggregation on source.ip, displayed as a pie chart
   • BA filters aggregation with one filter for source.ip in the internal ranges and another for source.ip not in the internal ranges, displayed as a bar chart
   • CA date histogram on @timestamp with a metric of count, displayed as a line chart
   • DA cardinality aggregation on source.ip with a filter for internal IPs
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of applying a time range filter to a visualization in Kibana?

   • ATo focus the visualization on a specific time window, such as a security incident period
   • BTo permanently delete data outside the time range
   • CTo sort the data by time
   • DTo change the time zone of the visualization
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which Elasticsearch aggregation type would you use to count the number of distinct source IP addresses in a security event index?

   • Acardinality
   • Bsum
   • Cterms
   • Davg
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which visualization type is best suited for showing the trend of security events over time?

   • AData table
   • BPie chart
   • CLine chart
   • DTag cloud
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An analyst needs a dashboard panel that shows the number of distinct users who have failed to authenticate in the last hour. The analyst wants a single number displayed prominently. Which configuration should be used?

   • AA count aggregation on user.name with a filter for event.outcome: failure, displayed as a metric visualization
   • BA cardinality aggregation on user.name with a filter for event.outcome: failure, displayed as a metric visualization
   • CA filters aggregation for event.outcome: failure with a sub-aggregation of average on user.name
   • DA terms aggregation on user.name with a filter for event.outcome: failure, displayed as a bar chart
   Reveal Solution Discussion Select an answer first