Monitor Security-Related Events with Dashboards in the Security App ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An analyst is monitoring the 'Security Overview' dashboard and sees a visualization showing 'Top Attack Signatures'. The analyst notices a sudden increase in a specific signature and wants to determine if this is a false positive or a real attack. The analyst needs to see the source IPs and timestamps of the events. What is the most effective approach?

   • AEnable auto-refresh to see if the signature continues to increase.
   • BAdd a filter for the signature name to narrow the data.
   • CExport the dashboard to a PDF to share with the team.
   • DClick on the signature in the visualization to drill down into the events and review the source IPs and timestamps.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   On a security dashboard, a bar chart shows the count of security events by severity. What does the height of each bar represent?

   • AThe total bytes of data for that severity
   • BThe average duration of events for that severity
   • CThe number of unique hosts generating events
   • DThe number of events for that severity level
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   To have a security dashboard automatically update every 30 seconds, which control should the analyst configure?

   • AThe time filter
   • BThe search query
   • CThe refresh interval
   • DThe panel settings
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC manager wants the 'Network' dashboard to show a specific set of panels that are most relevant to their team's daily monitoring. They want to create a personalized version without affecting the default dashboard. What should the manager do?

   • ACreate a new dashboard from scratch and manually add all the panels.
   • BUse the 'Share' feature to create a link and share it with the team.
   • CEdit the 'Network' dashboard and save it, overwriting the original.
   • DOpen the 'Network' dashboard, edit it, rearrange panels, and save it as a new dashboard with a different name.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is investigating a phishing campaign and wants to see all events related to a specific user 'jdoe' on the 'Security Overview' dashboard. The analyst also wants to see the details of each event. What is the most efficient approach?

   • AUse the global search bar to search for 'jdoe' and review the results.
   • BOpen the 'Users' page and search for 'jdoe'.
   • CAdd a KQL filter for 'user.name: jdoe' and then click on a visualization to drill down into the events.
   • DChange the time range to 'Last 1 hour' to see recent events for all users.
   Reveal Solution Discussion Select an answer first