Create Aggregation-Based Visualizations for Security Use Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   To calculate the total number of bytes transferred in all network events, which metric aggregation should be used?

   • Asum
   • Bavg
   • Cmax
   • Dcount
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   To create a visualization that shows the count of events per day, broken down by event category, which approach should be used?

   • AA single date_histogram aggregation
   • BA terms aggregation on event.category with a nested date_histogram
   • CA single terms aggregation on event.category
   • DA date_histogram with a nested terms aggregation on event.category
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which Elasticsearch aggregation is specifically designed to group documents into time-based buckets for visualizing events over time?

   • Arange
   • Bterms
   • Chistogram
   • Ddate_histogram
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which approach is recommended for paginating through a large number of buckets in a multi-field grouping?

   • AUsing a composite aggregation
   • BIncreasing the `size` parameter to a very high number
   • CUsing multiple terms aggregations
   • DUsing a filter aggregation
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   A security analyst needs to find the maximum severity score across all alerts in the last 24 hours. Which aggregation type should be used?

   • Amin
   • Bmax
   • Ccount
   • Dunique_count
   Reveal Solution Discussion Select an answer first