A SOC analyst is investigating a suspected brute-force attack and has opened a dashboard showing authentication events. The analyst wants to temporarily narrow the view to only show events from a specific source IP address, without permanently altering the saved dashboard for other team members. What is the most appropriate action?

Click the source IP value in a panel and choose 'Filter for value'

Edit the underlying visualization and add a query filter, then save the dashboard

Create a new dashboard from the current one and apply the filter there

Use the global search bar to type the source IP and press Enter

Which of the following is a valid way to create a new dashboard in Elastic?

From the Dashboards page, click 'Create dashboard'

From the Management page, click 'New dashboard'

From the Alerts page, click 'Generate dashboard'

From the Discover page, click 'Save as dashboard'

A security team has been using a dashboard for several months. They have decided to retire it and replace it with a new one. The team wants to remove the old dashboard from Kibana to avoid confusion. What is the most appropriate action?

Change the dashboard's title to 'Deprecated' and leave it in place

Export the dashboard to a file and then delete it

Duplicate the dashboard and then delete the original

Delete the dashboard from the dashboard management page

A security analyst has a dashboard with a large bar chart showing alerts by user. The analyst wants to make the chart smaller and place it in the top-right corner of the dashboard, next to a line chart. What is the correct way to reposition and resize the panel?

Use the dashboard's 'Layout' menu to enter a custom grid coordinate for the panel

Delete the panel and re-add it from the visualization library, then use the arrow keys to position it

Edit the visualization's settings and change the width and height properties in the Lens editor

Click the panel's header, drag it to the desired location, and use the resize handle on the bottom-right corner

An analyst is investigating a security incident and has a dashboard with multiple panels. The analyst wants to see only events from the last 24 hours, but the dashboard is currently showing data from the last 7 days. What is the most efficient way to change the time range for the entire dashboard?

Add a filter for '@timestamp >= now-24h' in the filter bar

Use the time picker in the top-right corner of the dashboard to select 'Last 24 hours'

Edit each panel individually and change its time range setting

Click on the dashboard's title and select 'Set time range'

ElasticCertified SIEM Analyst

Domain 5Objective 2

Demonstrate the Use of Dashboards ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 5)

Part of the Dashboards domain, which makes up ~11% of our current practice bank.

26questions here

6free pages

8concepts

Questions 21–25

21application · medium
A SOC analyst is investigating a suspected brute-force attack and has opened a dashboard showing authentication events. The analyst wants to temporarily narrow the view to only show events from a specific source IP address, without permanently altering the saved dashboard for other team members. What is the most appropriate action?
Select an answer first
22foundation · easy
Which of the following is a valid way to create a new dashboard in Elastic?
Select an answer first
23application · easy
A security team has been using a dashboard for several months. They have decided to retire it and replace it with a new one. The team wants to remove the old dashboard from Kibana to avoid confusion. What is the most appropriate action?
Select an answer first
24application · medium
A security analyst has a dashboard with a large bar chart showing alerts by user. The analyst wants to make the chart smaller and place it in the top-right corner of the dashboard, next to a line chart. What is the correct way to reposition and resize the panel?
Select an answer first
25application · easy
An analyst is investigating a security incident and has a dashboard with multiple panels. The analyst wants to see only events from the last 24 hours, but the dashboard is currently showing data from the last 7 days. What is the most efficient way to change the time range for the entire dashboard?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.