Recognize the Capabilities of the Security App ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is investigating a series of alerts that appear to be part of a coordinated attack. The analyst has identified a pattern of events across multiple hosts and wants to determine if the same user is responsible. The analyst wants to correlate events from different hosts and users in a single view, and also wants to save this correlation for future reference. What should the analyst do?

   • ACreate a case and add all the alerts to it
   • BCreate a Timeline, add events from all relevant hosts and users, and save the Timeline for future reference
   • CUse the Alerts page to filter by user and host
   • DUse the Hosts page to view each host's events separately and manually compare them
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A SOC team is evaluating whether to adopt the Elastic Security App as their primary investigation platform. They have a requirement to centralize alert triage, case management, and event investigation in a single tool. They also need to ensure that the tool can ingest data from their existing EDR and firewall solutions. Which statement best describes the Security App's capability in this context?

   • AThe Security App can only ingest data from Elastic Agent and cannot integrate with third-party solutions
   • BThe Security App is primarily a visualization tool and requires external tools for case management and investigation
   • CThe Security App provides a unified interface for alerts, cases, and investigations, and can ingest data from various sources through Elastic integrations
   • DThe Security App is a standalone product that does not rely on the Elastic Stack
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In a Timeline, what is the purpose of adding an event to the timeline?

   • ATo preserve it as evidence and build a sequence of related events
   • BTo change the event's timestamp
   • CTo permanently delete the event from Elasticsearch
   • DTo automatically create a detection rule
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a primary function of the Security App?

   • AAdministering user roles and permissions
   • BSetting up network load balancers
   • CManaging detection rules and alerts
   • DConfiguring Elasticsearch index mappings
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of customizing a detection rule in the Security App?

   • ATo change the color scheme of the Security App
   • BTo delete all historical alerts
   • CTo adjust the rule's query or conditions to better fit the organization's environment
   • DTo change the index pattern of the entire cluster
   Reveal Solution Discussion Select an answer first