To inspect the individual security events behind a dashboard metric, what should an analyst do?

Click on the metric or its surrounding panel to open the underlying data

Change the dashboard's time range to a wider interval

Add a new filter for the metric's value

A SOC analyst is monitoring the 'Endpoint Security' dashboard and needs to focus only on events from the 'web-server-01' host that occurred in the last hour. The dashboard currently shows all hosts for the last 24 hours. Which sequence of actions should the analyst perform?

Click on the 'web-server-01' value in a visualization to apply a filter.

Change the time range to 'Last 1 hour' and then refresh the dashboard.

Open the 'Hosts' page and search for 'web-server-01'.

Apply a KQL filter for 'host.name: web-server-01' and set the time range to 'Last 1 hour'.

A security analyst wants to add a new panel to the 'Authentication' dashboard that shows 'Top Source IPs' for failed logins. The analyst has already created the visualization in a saved search. What is the next step to add it to the dashboard?

Edit the dashboard, click 'Add panel', and select the saved visualization from the list.

Create a new dashboard and add the visualization there.

Use the 'Share' feature to embed the visualization in the dashboard.

Apply a filter to the dashboard to show the visualization.

An analyst is viewing the 'Network' dashboard and sees a large spike in the 'Top Source IPs' visualization. The analyst needs to determine whether this spike represents a real threat or just normal traffic. Which action is most appropriate to investigate the spike?

Export the dashboard as a PDF to share with the team for analysis.

Click on the spike in the visualization to drill down into the underlying network events.

Add a filter for 'event.category: network' to narrow the data shown.

Adjust the time range to the last 24 hours to see if the spike is a recurring pattern.

ElasticCertified SIEM Analyst

Domain 6Objective 7

Monitor Security-Related Events with Dashboards in the Security App ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 5)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

28questions here

6free pages

6concepts

Questions 21–25

21foundation · easy
To inspect the individual security events behind a dashboard metric, what should an analyst do?
Select an answer first
22application · medium
A SOC analyst is monitoring the 'Endpoint Security' dashboard and needs to focus only on events from the 'web-server-01' host that occurred in the last hour. The dashboard currently shows all hosts for the last 24 hours. Which sequence of actions should the analyst perform?
Select an answer first
23application · medium
A security analyst wants to add a new panel to the 'Authentication' dashboard that shows 'Top Source IPs' for failed logins. The analyst has already created the visualization in a saved search. What is the next step to add it to the dashboard?
Select an answer first
24application · medium
An analyst is viewing the 'Network' dashboard and sees a large spike in the 'Top Source IPs' visualization. The analyst needs to determine whether this spike represents a real threat or just normal traffic. Which action is most appropriate to investigate the spike?
Select an answer first
25foundation · easy
Which of the following is a prebuilt security dashboard available in the Elastic Security App?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.