Monitor Security-Related Events with Dashboards in the Security App ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   To view only security events from a specific host on a dashboard, which action should the analyst take?

   • AEdit the dashboard title
   • BChange the dashboard's refresh interval
   • CAdd a filter for the host name field
   • DSwitch to full screen mode
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is viewing the 'Security Overview' dashboard and sees a table with 'Top Alerts'. The analyst wants to see the full event details for a specific alert, including the raw JSON. What is the best way to do this?

   • AUse the 'Inspect' feature on the dashboard to view the raw data.
   • BTake a screenshot of the alert and zoom in on the details.
   • CClick on the alert in the table to open the event in Discover, then expand the document to view the raw JSON.
   • DExport the dashboard to a CSV file to see the raw data.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst needs to quickly review the last 30 minutes of failed authentication attempts across all Windows servers. The analyst opens the Security App and wants to land directly on the most relevant prebuilt dashboard. Which action should the analyst take first?

   • ANavigate to the 'Hosts' page and filter by Windows operating systems.
   • BOpen the 'Authentication' dashboard from the Dashboards list in the Security App.
   • CUse the global search bar to type 'failed authentication' and press Enter.
   • DCreate a new custom dashboard from scratch and add a search for 'event.action:login'.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   While viewing a bar chart on a security dashboard, an analyst clicks on a bar representing 'high' severity events. What is the expected outcome?

   • AThe dashboard filters to show only high-severity events
   • BThe dashboard enters full screen mode
   • CThe bar chart is deleted from the dashboard
   • DThe dashboard refreshes with the same data
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst is looking at the 'DNS' dashboard and sees a visualization titled 'Top DNS Queries by Count'. The analyst wants to understand which specific domains are generating the most traffic and then investigate one of them. What should the analyst do?

   • AChange the visualization type to a pie chart to better see the proportions.
   • BAdd a filter for 'dns.question.name: *' to see all DNS queries.
   • CExport the dashboard to a CSV file to analyze the data offline.
   • DExamine the visualization to identify the top domain, then click on that domain to drill down into the query events.
   Reveal Solution Discussion Select an answer first