During a joint investigation, two analysts have different interpretations of the evidence. They want to document both perspectives without changing the case status. What is the best approach?

Change the case status to 'in-progress' to indicate discussion.

Create a new case for the second interpretation.

Add comments to the case with each analyst's interpretation.

Update the case description with the conflicting views.

What is the purpose of case metrics in Elastic Security?

To analyze case handling and resolution performance

To configure alert notifications

A critical case is assigned to an analyst who is going on leave. The team lead needs to ensure the case is handled without delay. What should the team lead do?

Reassign the case to another analyst and update the status to 'in-progress'.

Leave the case assigned to the analyst on leave and add a comment.

Change the severity to 'critical' to attract attention.

Close the case and reopen it later.

What is the primary purpose of adding comments to a case in Elastic Security?

To change the case's severity level

To document investigation notes and facilitate collaboration

To automatically trigger a new alert

To delete the case from the system

A SOC analyst detects a series of failed login attempts followed by a successful login from an unusual geographic location. The analyst wants to document this as a single security issue and add context for the team. What should the analyst do first?

Change the status of the alerts to 'in-progress'.

Create a new case and link the related alerts to it.

Assign the alerts to a user for investigation.

Add a comment to an existing case describing the activity.

ElasticCertified SIEM Analyst

Domain 6Objective 6

Track Security Issues Using Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 1)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

36questions here

8free pages

9concepts

Questions 1–5

1expert · hard
During a joint investigation, two analysts have different interpretations of the evidence. They want to document both perspectives without changing the case status. What is the best approach?
Select an answer first
2foundation · easy
What is the purpose of case metrics in Elastic Security?
Select an answer first
3expert · hard
A critical case is assigned to an analyst who is going on leave. The team lead needs to ensure the case is handled without delay. What should the team lead do?
Select an answer first
4foundation · easy
What is the primary purpose of adding comments to a case in Elastic Security?
Select an answer first
5application · medium
A SOC analyst detects a series of failed login attempts followed by a successful login from an unusual geographic location. The analyst wants to document this as a single security issue and add context for the team. What should the analyst do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.