While reviewing the 'Security Overview' dashboard, an analyst notices a high number of 'Failed Logins' in a table visualization. The analyst needs to see the specific usernames and source IPs for these failed attempts. What is the most efficient way to do this?

Click on the 'Failed Logins' value in the table to open the underlying events in Discover.

Take a screenshot of the dashboard and zoom in on the table.

Switch to the 'Hosts' page and look for failed login information.

Export the dashboard to CSV to see the raw data.

A new analyst is joining the SOC team and needs to access the prebuilt 'Endpoint Security' dashboard. The analyst is logged into Kibana but does not see the dashboard in the list. What is the most likely reason and solution?

The dashboard is not in the current space; the analyst should switch to the correct Kibana space.

The dashboard is hidden by default; the analyst should use the search bar to find it.

The analyst does not have the correct index pattern; they should create a new one.

The analyst needs to create the dashboard from scratch because it is not prebuilt.

An analyst is monitoring the 'Network' dashboard and sees a steady increase in the 'Bytes Sent' metric over the last hour. The analyst wants to determine if this is a gradual trend or a sudden spike. What should the analyst do?

Add a filter for 'network.bytes: > 1000' to see only large transfers.

Enable auto-refresh to see the metric update in real-time.

Click on the metric to drill down into the underlying events.

Adjust the time range to show the last 24 hours and compare the current trend to the previous day.

ElasticCertified SIEM Analyst

Domain 6Objective 7

Monitor Security-Related Events with Dashboards in the Security App ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 6)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

28questions here

6free pages

6concepts

Questions 26–28

26application · medium
While reviewing the 'Security Overview' dashboard, an analyst notices a high number of 'Failed Logins' in a table visualization. The analyst needs to see the specific usernames and source IPs for these failed attempts. What is the most efficient way to do this?
Select an answer first
27application · medium
A new analyst is joining the SOC team and needs to access the prebuilt 'Endpoint Security' dashboard. The analyst is logged into Kibana but does not see the dashboard in the list. What is the most likely reason and solution?
Select an answer first
28application · medium
An analyst is monitoring the 'Network' dashboard and sees a steady increase in the 'Bytes Sent' metric over the last hour. The analyst wants to determine if this is a gradual trend or a sudden spike. What should the analyst do?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.

Monitor Security-Related Events with Dashboards in the Security App ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 6)

Questions 26–28

While reviewing the 'Security Overview' dashboard, an analyst notices a high number of 'Failed Logins' in a table visualization. The analyst needs to see the specific usernames and source IPs for these failed attempts. What is the most efficient way to do this?

A new analyst is joining the SOC team and needs to access the prebuilt 'Endpoint Security' dashboard. The analyst is logged into Kibana but does not see the dashboard in the list. What is the most likely reason and solution?

An analyst is monitoring the 'Network' dashboard and sees a steady increase in the 'Bytes Sent' metric over the last hour. The analyst wants to determine if this is a gradual trend or a sudden spike. What should the analyst do?

Keep studying — Security Application