An analyst is viewing a dashboard with a bar chart showing alerts by severity. The analyst wants to see the exact number of 'High' severity alerts. What is the most direct way to get this information?

Add a filter for 'alert.severity: High' and look at the total

Hover over the 'High' bar in the chart

Click on the 'High' bar to open the underlying documents

Edit the panel and change the visualization to a data table

A security team has a production dashboard that is working well. They want to experiment with a new layout and additional panels without risking the current version. What is the best way to proceed?

Create a new dashboard from scratch and manually recreate all the panels

Edit the original dashboard and save it with a new name

Export the dashboard to a file, then re-import it after making changes

Duplicate the dashboard and make changes to the copy

A new SOC analyst is learning to use Elastic SIEM. The analyst has opened a dashboard and notices that the data changes when clicking on different parts of a visualization. What is the primary purpose of this interactive behavior?

To change the layout of the dashboard panels

To modify the underlying visualization's configuration

To refresh the data in the dashboard

To allow the analyst to drill down into the underlying data and apply filters

A security analyst wants to create a new dashboard to monitor failed login attempts. The analyst has a clear idea of the required visualizations and wants to build them from scratch. What is the most appropriate way to start?

Duplicate an existing dashboard and modify its panels

Use the 'Import' feature to load a pre-built dashboard template

Create a new visualization first, then create a dashboard and add it

Create a new dashboard and use the 'Add panel' button to create new visualizations

A SOC analyst is viewing a dashboard with a pie chart of alert categories. The analyst notices an unusually large slice for 'Malware' and wants to see the individual events that make up that slice. What is the most direct way to investigate?

Hover over the 'Malware' slice to see a tooltip with the event list

Switch the dashboard to 'Edit' mode and change the pie chart to a data table

Click on the 'Malware' slice in the pie chart

Add a filter for 'event.category: Malware' in the dashboard filter bar

ElasticCertified SIEM Analyst

Domain 5Objective 2

Demonstrate the Use of Dashboards ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 2)

Part of the Dashboards domain, which makes up ~11% of our current practice bank.

26questions here

6free pages

8concepts

Questions 6–10

6application · easy
An analyst is viewing a dashboard with a bar chart showing alerts by severity. The analyst wants to see the exact number of 'High' severity alerts. What is the most direct way to get this information?
Select an answer first
7application · medium
A security team has a production dashboard that is working well. They want to experiment with a new layout and additional panels without risking the current version. What is the best way to proceed?
Select an answer first
8application · easy
A new SOC analyst is learning to use Elastic SIEM. The analyst has opened a dashboard and notices that the data changes when clicking on different parts of a visualization. What is the primary purpose of this interactive behavior?
Select an answer first
9application · easy
A security analyst wants to create a new dashboard to monitor failed login attempts. The analyst has a clear idea of the required visualizations and wants to build them from scratch. What is the most appropriate way to start?
Select an answer first
10application · medium
A SOC analyst is viewing a dashboard with a pie chart of alert categories. The analyst notices an unusually large slice for 'Malware' and wants to see the individual events that make up that slice. What is the most direct way to investigate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.