A team is ingesting network flow data and wants to store the number of bytes transferred. Which ECS field and data type should they use?

network.packets: 1024 (integer)

According to ECS guidelines, when should you use the field 'event.action'?

To identify the software that generated the event.

To describe the outcome of an event, such as 'success' or 'failure'.

To store the raw log message of the event.

To specify the action performed by the event, such as 'user_login' or 'file_delete'.

What is the ECS guideline for using custom fields in event data?

Custom fields should be used only when no existing ECS field fits, and they should be grouped under a custom field set.

Custom fields are not allowed; all data must fit into existing ECS fields.

Custom fields can be used freely without any restrictions.

Custom fields are allowed but should be prefixed with an underscore to avoid conflicts.

What is the purpose of validating event data against ECS?

To ensure that all events are stored in the same index.

To ensure that field names, types, and formats are consistent and compliant with ECS, enabling interoperability.

To encrypt event data before it is sent to Elasticsearch.

To automatically correct any errors in the event data.

A large organization is consolidating security logs from multiple sources into a single Elasticsearch cluster. They have two main sources: firewall logs that use 'src_ip' and 'dst_ip', and IDS logs that use 'source.ip' and 'destination.ip'. They want to enable cross-source correlation. What is the best approach?

Keep the fields as they are and use aliases in Kibana.

Use an ingest pipeline to rename 'src_ip' to 'source.ip' and 'dst_ip' to 'destination.ip'.

Use a custom field like 'source_address' for both sources.

Index the logs into separate indices and use cross-cluster search.

ElasticCertified SIEM Analyst

Domain 2Objective 1

Examine the Application and Guidelines of ECS ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 4)

Part of the Elastic Common Schema (ECS) domain, which makes up ~5% of our current practice bank.

23questions here

5free pages

6concepts

Questions 16–20

16application · medium
A team is ingesting network flow data and wants to store the number of bytes transferred. Which ECS field and data type should they use?
Select an answer first
17foundation · easy
According to ECS guidelines, when should you use the field 'event.action'?
Select an answer first
18foundation · easy
What is the ECS guideline for using custom fields in event data?
Select an answer first
19foundation · easy
What is the purpose of validating event data against ECS?
Select an answer first
20expert · hard
A large organization is consolidating security logs from multiple sources into a single Elasticsearch cluster. They have two main sources: firewall logs that use 'src_ip' and 'dst_ip', and IDS logs that use 'source.ip' and 'destination.ip'. They want to enable cross-source correlation. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.