A security analyst is building a new dashboard for the incident response team. The analyst has added a table of recent alerts and a line chart of alert volume over time. The analyst wants the line chart to appear directly above the table so the team can see the trend and then the details. What is the most efficient way to arrange these panels?

Edit the line chart's visualization settings to change its position

Delete the table panel and re-add it below the line chart

Drag the line chart panel by its header and drop it above the table panel

Use the 'Move up' button in the panel's context menu

An analyst is building a dashboard for a SOC team. The analyst has added a large map visualization and a small table. The analyst wants the map to take up most of the dashboard's width, but the table should be placed below it and span the full width. The analyst is in edit mode. What is the most efficient way to achieve this layout?

Use the dashboard's 'Grid settings' menu to set the exact pixel dimensions for each panel

Delete the table, add it again, and use the 'Auto-layout' feature to arrange the panels

Edit the map's visualization settings to set its width to 80% and the table's width to 100%

Drag the map panel to the top, resize it to span most of the width, then drag the table below it and resize it to span the full width

A security team has built a comprehensive executive summary dashboard in Elastic SIEM. The team lead wants to share a read-only version with the CISO, who does not have an Elastic account, so the CISO can view it in a browser without logging in. What is the most appropriate way to accomplish this?

Duplicate the dashboard, set the duplicate to 'read-only', and send the link

Share the dashboard via a direct Kibana link after setting the CISO's user role to 'viewer'

Embed the dashboard in an internal wiki page using an iframe with the 'share' embed code

Export the dashboard as a PDF and email it to the CISO

When you create a dashboard from an existing visualization, what happens to the original visualization?

It is deleted after being added to the dashboard

It is moved to the new dashboard and removed from its original location

It is converted into a saved search and no longer appears as a visualization

It is copied into the new dashboard, and the original remains unchanged

An analyst has a dashboard with a data table that shows the top 10 source IPs. The analyst wants to change the table to show the top 20 source IPs. What is the most appropriate way to make this change?

Edit the panel and change the 'Rows per page' setting in the table's configuration

Use the dashboard filter bar to add a filter for 'top 20 source IPs'

Resize the panel to make it taller so more rows are visible

Click on the table and use the 'Inspect' menu to change the row limit

ElasticCertified SIEM Analyst

Domain 5Objective 2

Demonstrate the Use of Dashboards ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 4)

Part of the Dashboards domain, which makes up ~11% of our current practice bank.

26questions here

6free pages

8concepts

Questions 16–20

16application · medium
A security analyst is building a new dashboard for the incident response team. The analyst has added a table of recent alerts and a line chart of alert volume over time. The analyst wants the line chart to appear directly above the table so the team can see the trend and then the details. What is the most efficient way to arrange these panels?
Select an answer first
17expert · medium
An analyst is building a dashboard for a SOC team. The analyst has added a large map visualization and a small table. The analyst wants the map to take up most of the dashboard's width, but the table should be placed below it and span the full width. The analyst is in edit mode. What is the most efficient way to achieve this layout?
Select an answer first
18application · medium
A security team has built a comprehensive executive summary dashboard in Elastic SIEM. The team lead wants to share a read-only version with the CISO, who does not have an Elastic account, so the CISO can view it in a browser without logging in. What is the most appropriate way to accomplish this?
Select an answer first
19foundation · easy
When you create a dashboard from an existing visualization, what happens to the original visualization?
Select an answer first
20application · medium
An analyst has a dashboard with a data table that shows the top 10 source IPs. The analyst wants to change the table to show the top 20 source IPs. What is the most appropriate way to make this change?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.

Demonstrate the Use of Dashboards ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 4)

Questions 16–20

A security team has built a comprehensive executive summary dashboard in Elastic SIEM. The team lead wants to share a read-only version with the CISO, who does not have an Elastic account, so the CISO can view it in a browser without logging in. What is the most appropriate way to accomplish this?

When you create a dashboard from an existing visualization, what happens to the original visualization?

An analyst has a dashboard with a data table that shows the top 10 source IPs. The analyst wants to change the table to show the top 20 source IPs. What is the most appropriate way to make this change?

Keep studying — Dashboards