ElasticCertified SIEM Analyst
Domain 4Objective 1
Create Aggregation-Based Visualizations for Security Use Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 7)
Part of the Visualizations domain, which makes up ~13% of our current practice bank.
34questions here
7free pages
15concepts
Questions 31–34
- 31
A junior analyst needs to quickly create a visualization showing the count of security events by severity level for the last 30 days. The analyst is unfamiliar with the Elasticsearch aggregation API and wants to use the most interactive, GUI-based tool. Which tool should the analyst use?
Select an answer first - 32
Which aggregation is used to calculate the number of distinct values in a field, such as the number of unique users who logged in?
Select an answer first - 33
A security analyst is investigating a ransomware outbreak that occurred on March 15 between 09:00 and 10:00. The analyst has a saved visualization showing file event counts over time. The analyst wants to focus the visualization on the exact incident window. What should the analyst do?
Select an answer first - 34
What is the primary purpose of the `size` parameter in a terms aggregation?
Select an answer first
Finished these 4 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to ELASTIC-CERTIFIED-SIEM-ANALYST
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.