Examine the Application and Guidelines of ECS ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In ECS, which field category is used to describe the operating system and architecture of a device?

   • Asystem
   • Bos
   • Chost
   • Ddevice
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How does ECS structure event data to achieve consistency across different data sources?

   • ABy using a flat, non-hierarchical list of fields that every event must contain.
   • BBy requiring all events to be stored in a single index with a fixed mapping.
   • CBy converting all event data into a single proprietary format before ingestion.
   • DBy defining a hierarchical set of fields organized into categories, with nested objects for related information.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How should a field representing the process ID be named according to ECS conventions?

   • Aprocess.pid
   • Bpid.process
   • CProcessID
   • Dprocess_id
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the recommended ECS format for a timestamp field such as @timestamp?

   • AISO 8601 with timezone, e.g., 2023-10-05T14:30:00Z
   • BUnix epoch milliseconds, e.g., 1696506600000
   • CA human-readable string, e.g., 'October 5, 2023 at 2:30 PM'
   • DMM/DD/YYYY HH:MM:SS, e.g., 10/05/2023 14:30:00
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization is setting up a pipeline to ingest Windows event logs. They want to ensure the data is ECS-compliant before indexing. Which tool should they use?

   • AKibana Lens
   • BElasticsearch Ingest Pipelines
   • CLogstash
   • DBeats
   Reveal Solution Discussion Select an answer first