Customize the Discover Interface to Search for Data ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   An analyst has several columns in the Discover table and wants to move the `source.ip` column to the far left. What is the correct way to reorder columns?

   • ADrag the column header to the desired position
   • BUse the sort dropdown on the column
   • CRemove the column and add it again
   • DEdit the index pattern to change field order
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst is reviewing a large set of results and wants to focus on events that occurred between 09:00 and 10:00. The analyst has already sorted the table by timestamp. What is the most efficient way to narrow the results to that time window?

   • AUse the time filter to set the range to 09:00–10:00.
   • BAdd a filter for the timestamp field to be greater than 09:00.
   • CScroll through the pages to find events in that time range.
   • DChange the row density to 'comfortable' to see timestamps more clearly.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An analyst is examining authentication logs and needs to compare the source IP and user name for each event. The default table shows many fields, making it hard to focus. The analyst wants to see only the source.ip and user.name columns, with the source IP column first. What should the analyst do?

   • AChange the row density to 'compact' to show fewer fields.
   • BUse the search bar to type 'source.ip and user.name'.
   • CSort the table by source.ip and then by user.name.
   • DRemove all columns except source.ip and user.name, then drag source.ip to the left of user.name.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst is reviewing a table with many columns and finds that the text in the columns is truncated. The analyst wants to see the full content of the fields without losing any columns. Which Discover interface adjustment would best help?

   • AIncrease the column widths by dragging the column header borders.
   • BRemove some columns to make room for the remaining ones.
   • CChange the row density to 'compact'.
   • DSort the table by the truncated column.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   An analyst needs to find events where the field `event.action` equals `login` AND `source.ip` is `10.0.0.5`. Which KQL query in the Discover search bar correctly expresses this?

   • Aevent.action: login OR source.ip: 10.0.0.5
   • Bevent.action = login = source.ip = 10.0.0.5
   • Cevent.action login source.ip 10.0.0.5
   • Devent.action: login AND source.ip: 10.0.0.5
   Reveal Solution Discussion Select an answer first