Describe How the Detection Engine Searches Activity and Generates Alerts ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16application · easy

   An analyst is triaging alerts and notices that an alert has been open for several days. The analyst has started investigating but needs to indicate to the team that the alert is being actively worked on, while not yet resolving it. What should the analyst do?

   • AClose the alert.
   • BChange the alert's severity.
   • CReopen the alert.
   • DAcknowledge the alert.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary role of the Detection Engine in an Elastic SIEM deployment?

   • ATo encrypt data at rest and in transit to protect sensitive security information
   • BTo provide a user interface for analysts to manually query and visualize security data
   • CTo continuously search incoming activity data for matches against detection rules and generate alerts when matches occur
   • DTo store raw event data in a hot-warm-cold tiered storage architecture for long-term retention
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC team is implementing a process for handling alerts. They want to ensure that alerts are not forgotten and that there is a clear audit trail. They decide that all alerts must be acknowledged within 24 hours of creation and closed within 7 days. What is the best way to enforce this policy?

   • AAutomatically close all alerts after 7 days using a script.
   • BUse the alert statuses and add comments to document actions.
   • CDelete alerts that are not acknowledged within 24 hours.
   • DChange the alert severity to high if not acknowledged within 24 hours.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A new analyst asks how the Detection Engine is able to search through large volumes of data and generate alerts without manual intervention. Which statement best describes the Detection Engine's operation?

   • AIt uses machine learning to predict future security events and generates alerts proactively.
   • BIt continuously streams all events into a separate alert database and analyzes them in real time.
   • CIt manually executes rules when an analyst triggers them from the UI.
   • DIt runs scheduled queries against indices and creates alerts when the query results match the rule conditions.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A detection engineer needs to create a rule that alerts when the number of failed login attempts from a single source IP exceeds 10 within a 5-minute window. The rule should generate a single alert per source IP when the threshold is met. Which rule type and configuration should be used?

   • AQuery rule that searches for failed login events and generates an alert for each event.
   • BThreshold rule without grouping, with a threshold of 10 and a time window of 5 minutes.
   • CThreshold rule with a threshold of 10, a time window of 5 minutes, and grouping by source IP.
   • DCorrelation rule that combines failed login events with other events.
   Reveal Solution Discussion Select an answer first