In the Elastic Security application, what is the primary purpose of creating a case?

To generate visualizations for dashboards

To store raw event data for long-term retention

To track and manage a security issue through its lifecycle

To configure detection rules for automated alerts

During an investigation, an analyst discovers a new indicator of compromise (IOC) that should be shared with the team. The case is currently open. What is the most appropriate way to document this finding?

Add a comment to the case with the IOC details.

Attach the IOC as a file to the case.

Update the case title to include the IOC.

A security team wants to analyze their case handling performance over the last quarter, including how many cases were closed and the average time to close. What should they use?

Search and filter to manually count cases.

Export all cases and analyze in a spreadsheet.

Add comments to cases with performance notes.

Case metrics and reporting features.

A SOC team is handling a widespread phishing campaign. They have multiple alerts from different sources. The team lead wants to ensure all alerts are tracked under one case, with a clear owner and priority. What should the team lead do?

Create a case, link all alerts, assign it to a senior analyst, and set severity to 'high'.

Create one case, link all alerts, and set severity to 'low'.

Create a case for each alert and assign each to a different analyst.

Create one case, link all alerts, but leave it unassigned.

An analyst creates a case for a phishing incident. After initial review, the analyst determines the incident is a false positive and wants to document the conclusion and close the case. What should the analyst do?

Update the case description with the conclusion, then set the status to 'closed'.

Add a comment with the conclusion but leave the status as 'open'.

Delete the case to remove the false positive from the system.

Assign the case to another analyst for a second opinion.

ElasticCertified SIEM Analyst

Domain 6Objective 6

Track Security Issues Using Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 2)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

36questions here

8free pages

9concepts

Questions 6–10

6foundation · easy
In the Elastic Security application, what is the primary purpose of creating a case?
Select an answer first
7application · medium
During an investigation, an analyst discovers a new indicator of compromise (IOC) that should be shared with the team. The case is currently open. What is the most appropriate way to document this finding?
Select an answer first
8application · medium
A security team wants to analyze their case handling performance over the last quarter, including how many cases were closed and the average time to close. What should they use?
Select an answer first
9expert · hard
A SOC team is handling a widespread phishing campaign. They have multiple alerts from different sources. The team lead wants to ensure all alerts are tracked under one case, with a clear owner and priority. What should the team lead do?
Select an answer first
10application · medium
An analyst creates a case for a phishing incident. After initial review, the analyst determines the incident is a false positive and wants to document the conclusion and close the case. What should the analyst do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.