An organization uses Elastic Agent to collect endpoint data, and also ingests network flow logs from a third-party firewall. The security team wants to ensure that alerts generated from both data sources appear in the Security App's Alerts page. What is required for this to happen?

The Security App must be configured to connect directly to the firewall

The firewall logs must be converted to Elastic Common Schema (ECS) format

The data sources must be integrated with Elastic and have detection rules that generate alerts

The firewall logs must be stored in a separate index and viewed in Discover

What does a user's risk score on the User page represent?

The user's role in the organization

The number of failed password attempts

A calculated measure of the user's potential security risk based on activity

What is the purpose of the 'External alerts' section in the Security App?

To display alerts generated by external security tools integrated with Elastic

To show alerts from the Elastic detection engine only

To manage user access to the Security App

To list all network connections

An analyst is investigating a potential lateral movement attack. The analyst has identified a compromised host and wants to see all network connections and processes on that host around the time of the compromise, and also wants to correlate this with any alerts triggered. What should the analyst do?

Create a new case and add the host as a description

Open the Hosts page, select the host, and use the Timeline feature to investigate its events

Go to the Alerts page and filter by the host name

Use the Network page to view all external alerts

ElasticCertified SIEM Analyst

Domain 6Objective 1

Recognize the Capabilities of the Security App ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 6)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

35questions here

7free pages

10concepts

Questions 26–30

26application · medium
An organization uses Elastic Agent to collect endpoint data, and also ingests network flow logs from a third-party firewall. The security team wants to ensure that alerts generated from both data sources appear in the Security App's Alerts page. What is required for this to happen?
Select an answer first
27foundation · easy
What does a user's risk score on the User page represent?
Select an answer first
28foundation · easy
What is the purpose of the 'External alerts' section in the Security App?
Select an answer first
29application · medium
An analyst is investigating a potential lateral movement attack. The analyst has identified a compromised host and wants to see all network connections and processes on that host around the time of the compromise, and also wants to correlate this with any alerts triggered. What should the analyst do?
Select an answer first
30foundation · easy
In the Security App, where would an analyst go to see a list of all detection alerts?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.

Recognize the Capabilities of the Security App ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 6)

Questions 26–30

An organization uses Elastic Agent to collect endpoint data, and also ingests network flow logs from a third-party firewall. The security team wants to ensure that alerts generated from both data sources appear in the Security App's Alerts page. What is required for this to happen?

What does a user's risk score on the User page represent?

What is the purpose of the 'External alerts' section in the Security App?

In the Security App, where would an analyst go to see a list of all detection alerts?

Keep studying — Security Application