ElasticCertified SIEM Analyst
Domain 1Objective 1
Describe Basic Stack Architecture ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 1)
Part of the Stack Architecture domain, which makes up ~12% of our current practice bank.
22questions here
5free pages
7concepts
Questions 1–5
- 1
A security team receives logs in a custom JSON format that must be normalized into ECS fields and enriched with threat intelligence before indexing. They have a central server where they can run processing. Which component should they use?
Select an answer first - 2
A company uses Winlogbeat to collect Windows Event Logs and sends them to Logstash for enrichment. After enrichment, where does Logstash send the data?
Select an answer first - 3
A company needs to collect system metrics from 1,000 Linux servers and send them to a central Elasticsearch cluster. They want a lightweight agent that uses minimal resources on each server. Which component should they deploy?
Select an answer first - 4
What is the primary role of Logstash in an Elastic Stack SIEM deployment?
Select an answer first - 5
A SIEM analyst needs to run a query that searches across billions of security events and returns results in under a second. Which component is responsible for this capability?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.