A case has been closed, but new evidence emerges that requires reopening the investigation. What should the analyst do?

Reopen the case by changing its status to 'open' and add a comment about the new evidence.

Create a new case for the new evidence.

Change the severity to 'critical' but keep it closed.

Leave the case closed and add a comment.

A case is open for a network breach. The analyst discovers that several alerts were mistakenly linked to the case. What should the analyst do to correct this?

Unlink the irrelevant alerts from the case.

Add a comment noting the alerts are irrelevant.

Change the status of the irrelevant alerts to 'closed'.

Create a new case for the irrelevant alerts.

Which action in the Elastic Security application initiates the creation of a new case?

Running a new search in the Discover tab

Clicking the 'Create case' button in the Cases page

Modifying a detection rule's settings

Adding a comment to an existing alert

Where do comments appear in relation to a case in Elastic Security?

On the detection rule configuration page

In the Elasticsearch index mapping

ElasticCertified SIEM Analyst

Domain 6Objective 6

Track Security Issues Using Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 3)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

36questions here

8free pages

9concepts

Questions 11–15

11expert · hard
A case has been closed, but new evidence emerges that requires reopening the investigation. What should the analyst do?
Select an answer first
12foundation · easy
In Elastic Security, what can be linked to a case to associate related security events?
Select an answer first
13expert · hard
A case is open for a network breach. The analyst discovers that several alerts were mistakenly linked to the case. What should the analyst do to correct this?
Select an answer first
14foundation · easy
Which action in the Elastic Security application initiates the creation of a new case?
Select an answer first
15foundation · easy
Where do comments appear in relation to a case in Elastic Security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.