A security analyst is monitoring a DDoS attack and needs to see the most current data on the 'Network' dashboard. The analyst wants the dashboard to refresh every 10 seconds. Which setting should the analyst use?

Edit the dashboard and add a custom script to refresh the page.

Use the browser's refresh button every 10 seconds.

Set the auto-refresh interval to 10 seconds in the time picker.

Set the time range to 'Last 10 seconds' and manually refresh.

A security team frequently uses the 'Network' dashboard but finds the 'Top Protocols' panel unnecessary and wants to add a panel showing 'Top Destination Ports'. They want to save this modified view for the team to use. What should the analyst do?

Create a new dashboard from scratch and add only the 'Top Destination Ports' panel.

Edit the dashboard, remove the 'Top Protocols' panel, add a new 'Top Destination Ports' panel, and save the dashboard.

Use the 'Share' feature to send the current dashboard to the team and ask them to modify it locally.

Apply a filter to hide the 'Top Protocols' panel and then bookmark the URL.

An analyst needs to see security events as they occur in near real-time. What is the most appropriate approach?

Set a short refresh interval on the dashboard

Use a static time range of last month

Disable the dashboard's auto-refresh

An analyst is viewing the 'Hosts' dashboard and sees a table with 'Top Processes'. The analyst wants to see the command line arguments for a specific process to determine if it is malicious. What is the best way to get this information?

Add a filter for 'process.name: ' and look at the table again.

Click on the process name in the table to drill down into the process events and view the 'process.command_line' field.

Search for the process name in the global search bar.

Export the dashboard to a PDF and look for the command line in the report.

A security analyst is on-call and needs to monitor the 'Security Overview' dashboard for new alerts as they come in. The analyst wants the dashboard to automatically update every 30 seconds. Where should the analyst configure this?

Use the browser's developer tools to set a JavaScript timer for page reload.

Use the time picker in the top-right corner of the dashboard and select a refresh interval of 30 seconds.

Set the time range to 'Last 30 seconds' and manually refresh the page.

Edit the dashboard and add a custom panel for auto-refresh.

ElasticCertified SIEM Analyst

Domain 6Objective 7

Monitor Security-Related Events with Dashboards in the Security App ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 1)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

28questions here

6free pages

6concepts

Questions 1–5

1application · medium
A security analyst is monitoring a DDoS attack and needs to see the most current data on the 'Network' dashboard. The analyst wants the dashboard to refresh every 10 seconds. Which setting should the analyst use?
Select an answer first
2application · medium
A security team frequently uses the 'Network' dashboard but finds the 'Top Protocols' panel unnecessary and wants to add a panel showing 'Top Destination Ports'. They want to save this modified view for the team to use. What should the analyst do?
Select an answer first
3foundation · easy
An analyst needs to see security events as they occur in near real-time. What is the most appropriate approach?
Select an answer first
4application · medium
An analyst is viewing the 'Hosts' dashboard and sees a table with 'Top Processes'. The analyst wants to see the command line arguments for a specific process to determine if it is malicious. What is the best way to get this information?
Select an answer first
5application · medium
A security analyst is on-call and needs to monitor the 'Security Overview' dashboard for new alerts as they come in. The analyst wants the dashboard to automatically update every 30 seconds. Where should the analyst configure this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.