A security analyst wants to collect Windows Defender logs from a group of Windows endpoints. They have already created an agent policy and enrolled the endpoints. What is the next step to start collecting these logs?

Add the Windows Defender integration to the agent policy and ensure the agents are assigned to that policy.

Create a new index template for Windows Defender logs in Elasticsearch.

Install the Windows Defender module on each endpoint using the Elastic Agent CLI.

Restart the Elastic Agent service on each endpoint to pick up the new configuration.

A Linux admin needs to install Elastic Agent on a new Ubuntu server. The Fleet Server is already running and the admin has a valid enrollment token. Which command should they run on the Ubuntu server?

sudo apt-get install elastic-agent --fleet-server=

sudo elastic-agent install --url=https://fleet-server:8220 --enrollment-token=

sudo systemctl start elastic-agent --enrollment-token=

sudo elastic-agent enroll --url=https://fleet-server:8220 --token=

Where can an administrator verify that an Elastic Agent has successfully enrolled and is active?

In the Kibana Discover tab, which shows agent enrollment logs by default.

In the Elasticsearch index management UI, where agent documents are stored.

In the Fleet UI under the Agents tab, where the agent's status is displayed.

In the host's system log, which records all Fleet Server communications.

Which of the following is a valid method to install an Elastic Agent on a host?

Download the agent package and run the install command provided in the Fleet UI.

Deploy the agent as a Kibana plugin by uploading it through the Kibana interface.

Compile the agent from source code on every target host manually.

Use the Elasticsearch REST API to push the agent binary directly to the host.

A company has two groups of servers: web servers that need to ship Nginx access logs and database servers that need to ship PostgreSQL logs. They want to manage these configurations centrally. What is the recommended approach in Fleet?

Create one agent policy for web servers with the Nginx integration, and another for database servers with the PostgreSQL integration.

Create a single agent policy with no integrations, then manually configure each server's log paths.

Create two agent policies, but assign both to all servers and rely on the agents to filter logs based on hostname.

Create a single agent policy that includes both the Nginx and PostgreSQL integrations, and assign it to all servers.

ElasticCertified SIEM Analyst

Domain 1Objective 2

Demonstrate Use of Fleet and Elastic Agents ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 5)

Part of the Stack Architecture domain, which makes up ~12% of our current practice bank.

27questions here

6free pages

7concepts

Questions 21–25

21application · medium
A security analyst wants to collect Windows Defender logs from a group of Windows endpoints. They have already created an agent policy and enrolled the endpoints. What is the next step to start collecting these logs?
Select an answer first
22application · medium
A Linux admin needs to install Elastic Agent on a new Ubuntu server. The Fleet Server is already running and the admin has a valid enrollment token. Which command should they run on the Ubuntu server?
Select an answer first
23foundation · easy
Where can an administrator verify that an Elastic Agent has successfully enrolled and is active?
Select an answer first
24foundation · easy
Which of the following is a valid method to install an Elastic Agent on a host?
Select an answer first
25application · medium
A company has two groups of servers: web servers that need to ship Nginx access logs and database servers that need to ship PostgreSQL logs. They want to manage these configurations centrally. What is the recommended approach in Fleet?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.