A security team is using Filebeat to ship logs to Logstash for enrichment. They notice that Logstash is occasionally dropping events during peak load. They need to ensure no data loss while maintaining the enrichment pipeline. Which approach should they take?

Configure Filebeat to use persistent queues and enable Logstash persistent queues

Disable the enrichment filters in Logstash

Send Filebeat output directly to Elasticsearch

Increase the number of Logstash workers

A company has a large Elasticsearch cluster with dedicated master, data, and ingest nodes. They want to add a component for visualization and management. Where should Kibana be deployed?

On a dedicated Kibana node or a separate server

Which statement best describes how Elasticsearch nodes interact in a distributed deployment?

Nodes communicate to share data and coordinate search requests

Nodes only store metadata and not actual data

Nodes operate independently and do not communicate

Each node stores a complete copy of all data

A small company wants to deploy the Elastic Stack for SIEM. They have a single server and need to collect logs from a few endpoints. They want to minimize infrastructure complexity. Which deployment architecture should they choose?

Use only Logstash and Elasticsearch, without Kibana

Install Elasticsearch on one server, Kibana on another, and Logstash on a third

Use only Beats and Kibana, without Elasticsearch

Install Elasticsearch, Kibana, and Logstash on the same server, and use Beats on the endpoints

ElasticCertified SIEM Analyst

Domain 1Objective 1

Describe Basic Stack Architecture ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 2)

Part of the Stack Architecture domain, which makes up ~12% of our current practice bank.

22questions here

5free pages

7concepts

Questions 6–10

6foundation · easy
Which Logstash component is responsible for defining how data is processed as it flows through the pipeline?
Select an answer first
7expert · hard
A security team is using Filebeat to ship logs to Logstash for enrichment. They notice that Logstash is occasionally dropping events during peak load. They need to ensure no data loss while maintaining the enrichment pipeline. Which approach should they take?
Select an answer first
8application · medium
A company has a large Elasticsearch cluster with dedicated master, data, and ingest nodes. They want to add a component for visualization and management. Where should Kibana be deployed?
Select an answer first
9foundation · easy
Which statement best describes how Elasticsearch nodes interact in a distributed deployment?
Select an answer first
10application · medium
A small company wants to deploy the Elastic Stack for SIEM. They have a single server and need to collect logs from a few endpoints. They want to minimize infrastructure complexity. Which deployment architecture should they choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.