Customize the Discover Interface to Search for Data ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is investigating a spike in network traffic and wants to know which destination ports are most common in the current result set. The analyst has already run a search for the relevant time range. What is the quickest way to see the top destination ports?

   • AUse the search bar to type `destination.port: *`.
   • BAdd destination.port as a column and sort by it.
   • CChange the row density to 'compact' to see more rows.
   • DOpen the field statistics for the destination.port field.
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   An analyst is investigating a brute-force attack and wants to identify the most common source IPs. The analyst has a query that returns all failed login events. The analyst opens field statistics for source.ip and sees a bar chart. However, the analyst wants to see the exact count for each IP. What should the analyst do?

   • AUse the search bar to type `source.ip: *` and then count the results.
   • BExport the results to CSV and use a spreadsheet to count.
   • CHover over the bars in the field statistics chart to see the exact counts.
   • DAdd source.ip as a column and sort by it.
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   An analyst is reviewing a large result set and wants to focus on the most recent events. The analyst has sorted the table by timestamp in descending order. However, the analyst notices that the table still shows some older events on the first page. What is the most likely reason for this?

   • AThe analyst is viewing a cached version of the results.
   • BThe pagination controls are set to show the last page first.
   • CThe sort is not applied because the timestamp field is not indexed.
   • DThe time filter is set to a range that includes older events, and the sort is working correctly.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An analyst wants to add the `user.name` field to the Discover results table. What is the correct action to display this field as a column?

   • AClick the field in the left sidebar and select 'Add to table'
   • BRight-click the table header and select 'Insert field'
   • CDrag the field onto the time picker
   • DType the field name in the search bar
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is working on a small laptop screen and finds the Discover table too crowded. The analyst wants to see more rows at once without losing any columns. Which Discover interface adjustment would best help?

   • AIncrease the column widths to see more text.
   • BRemove the less important columns from the table.
   • CChange the row density to 'compact'.
   • DUse the pagination controls to view fewer rows per page.
   Reveal Solution Discussion Select an answer first