After enrolling a new Elastic Agent, the agent shows 'Offline' in the Fleet UI. The agent host can reach the Fleet Server on port 8220. What is the most likely cause?

The agent policy does not include any integrations.

The agent's hostname is not resolvable by Fleet Server.

The agent's API key has expired or been revoked.

The agent is not sending data to Elasticsearch.

Which of the following is a common first step when troubleshooting an agent that is not sending data?

Reinstall the agent's operating system.

Delete the agent's index pattern in Kibana.

Check the agent's status in the Fleet UI and review its logs.

Restart the Elasticsearch cluster to reset the connection.

An admin is enrolling a new Elastic Agent and wants to ensure it receives the correct configuration. They have multiple agent policies. What should they do during enrollment?

Enroll the agent, then manually edit its configuration file to match the desired policy.

Enroll the agent, then reassign it to the desired policy in the Fleet UI.

Create a new policy during enrollment and assign it to the agent.

Use an enrollment token that is associated with the desired agent policy.

Where would an administrator go to add an integration to an existing agent policy?

In the Elasticsearch Dev Tools console, by writing a custom script.

In the Fleet UI, under Integrations, then selecting the policy to modify.

In the host's system settings, by editing the agent's YAML file directly.

In the Kibana Maps application, by configuring a new layer.

A company wants to collect both Windows Event Logs and PowerShell logs from a group of Windows servers. They have created an agent policy and added the Windows integration. What else do they need to do?

Install a separate Elastic Agent for PowerShell logs on each server.

Enable PowerShell logging in the Windows Event Log integration settings.

Add the PowerShell integration to the same agent policy.

Create a separate agent policy for PowerShell logs and assign it to the same agents.

ElasticCertified SIEM Analyst

Domain 1Objective 2

Demonstrate Use of Fleet and Elastic Agents ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 2)

Part of the Stack Architecture domain, which makes up ~12% of our current practice bank.

27questions here

6free pages

7concepts

Questions 6–10

6application · medium
After enrolling a new Elastic Agent, the agent shows 'Offline' in the Fleet UI. The agent host can reach the Fleet Server on port 8220. What is the most likely cause?
Select an answer first
7foundation · easy
Which of the following is a common first step when troubleshooting an agent that is not sending data?
Select an answer first
8application · medium
An admin is enrolling a new Elastic Agent and wants to ensure it receives the correct configuration. They have multiple agent policies. What should they do during enrollment?
Select an answer first
9foundation · easy
Where would an administrator go to add an integration to an existing agent policy?
Select an answer first
10application · medium
A company wants to collect both Windows Event Logs and PowerShell logs from a group of Windows servers. They have created an agent policy and added the Windows integration. What else do they need to do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.