Which action can an analyst perform directly on an alert from the Alerts page?

Change the index pattern of the alert

Modify the detection rule that generated it

Change its status to 'acknowledged'

Delete the underlying raw events from Elasticsearch

During an incident investigation, an analyst discovers a series of related alerts across multiple hosts. The analyst needs to document the findings, attach evidence from a Timeline, and assign tasks to other team members. What feature should the analyst use?

Use the Alerts page to mark all alerts as 'In progress'

Create a new Timeline and add all the alerts to it

Create a custom visualization to show the alerts on a dashboard

Create a new case and add the related alerts and Timeline as evidence

What is the primary purpose of the Security App in Elastic SIEM?

To provide a centralized interface for investigating, detecting, and responding to security threats

To exclusively manage Elasticsearch cluster health and performance

To serve as a data ingestion pipeline for raw logs

To replace the need for external threat intelligence feeds

A security analyst is reviewing the risk scores of hosts and users in the Security App. The analyst notices that a host has a high risk score but no associated alerts. The analyst wants to understand why the risk score is high and determine if there is any underlying suspicious activity. What should the analyst do?

Ignore the risk score because it is not based on alerts

Open the host's details page and review the associated events and risk contributions

Use the Network page to check for external alerts related to the host

Create a new detection rule to generate alerts for the host

ElasticCertified SIEM Analyst

Domain 6Objective 1

Recognize the Capabilities of the Security App ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 2)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

35questions here

7free pages

10concepts

Questions 6–10

6foundation · easy
Which action can an analyst perform directly on an alert from the Alerts page?
Select an answer first
7application · medium
During an incident investigation, an analyst discovers a series of related alerts across multiple hosts. The analyst needs to document the findings, attach evidence from a Timeline, and assign tasks to other team members. What feature should the analyst use?
Select an answer first
8foundation · easy
What is the primary purpose of the Security App in Elastic SIEM?
Select an answer first
9foundation · easy
Which UI element in the Security App provides a quick overview of the current security posture, including counts of alerts and cases?
Select an answer first
10expert · hard
A security analyst is reviewing the risk scores of hosts and users in the Security App. The analyst notices that a host has a high risk score but no associated alerts. The analyst wants to understand why the risk score is high and determine if there is any underlying suspicious activity. What should the analyst do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.

Recognize the Capabilities of the Security App ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 2)

Questions 6–10

Which action can an analyst perform directly on an alert from the Alerts page?

During an incident investigation, an analyst discovers a series of related alerts across multiple hosts. The analyst needs to document the findings, attach evidence from a Timeline, and assign tasks to other team members. What feature should the analyst use?

What is the primary purpose of the Security App in Elastic SIEM?

Which UI element in the Security App provides a quick overview of the current security posture, including counts of alerts and cases?

Keep studying — Security Application