Demonstrate Use of Fleet and Elastic Agents ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A Windows admin is trying to install Elastic Agent on a server using the command line. The installation fails with an error about a missing dependency. The server has no internet access. What is the most likely cause?

   • AThe Elastic Agent package was not downloaded on a machine with internet access and transferred to the server.
   • BThe Fleet Server URL is incorrect.
   • CThe enrollment token is invalid.
   • DThe server does not have the .NET Framework installed.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst has enrolled a new Elastic Agent and added the System integration to its policy. They want to confirm that system metrics are being ingested into Elasticsearch. Which action should they take?

   • ACheck the Elasticsearch cluster health; if it's green, data is being ingested.
   • BGo to Discover in Kibana and search for documents with the data stream 'metrics-system.system'.
   • CRun 'elastic-agent status' on the host to see if the agent is running.
   • DCheck the agent's status in the Fleet UI; if it shows 'Healthy', data is being ingested.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team has 50 agents enrolled in Fleet. They notice that some agents are 'Unhealthy' and are not sending data. The agents can reach the Fleet Server, and the Fleet Server can reach Elasticsearch. What is the most likely cause of the unhealthy status?

   • AThe agent policies have been deleted.
   • BThe agents' output configuration is pointing to an unreachable Elasticsearch cluster.
   • CThe agents have been unenrolled from Fleet.
   • DThe Fleet Server is overloaded and cannot handle the agent check-ins.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What happens when an Elastic Agent is enrolled into a Fleet Server?

   • AThe agent immediately starts sending all host data to Elasticsearch without any policy.
   • BThe agent is permanently locked to the first Fleet Server and cannot be moved.
   • CThe agent receives a unique ID and begins checking in with the Fleet Server for policy updates.
   • DThe agent's configuration is compiled into a static file that never changes.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   Several Elastic Agents are showing 'Unhealthy' status in Fleet. The agents are enrolled and can communicate with Fleet Server. What is the most likely cause?

   • AThe agents have been unenrolled from Fleet.
   • BThe Fleet Server is overloaded and cannot handle the agent check-ins.
   • CThe agent policies have been deleted.
   • DThe agents are not sending data to Elasticsearch due to a misconfigured output.
   Reveal Solution Discussion Select an answer first