An analyst has a large PCAP file (500 MB) that is critical evidence. The team has a policy to keep case attachments under 100 MB. What should the analyst do?

Compress the PCAP and attach the compressed file, noting the original location in a comment.

Attach the PCAP as-is, ignoring the policy.

Create a new case for the PCAP to avoid the size limit.

Add a comment with a link to the PCAP on a shared drive.

Which of the following is an example of a file attachment that could be added to a case?

A screenshot of a suspicious login attempt

A new Elasticsearch index template

A case is open for a malware outbreak. The analyst finds a new alert that is related to the same malware. What should the analyst do?

Change the status of the new alert to 'closed'.

Link the new alert to the existing case.

Add a comment about the new alert.

Create a new case for the new alert.

In Elastic Security, what can a case be assigned to?

A specific user or a group of users

A SOC manager wants to review all cases that are currently open and have a severity of 'high' to prioritize resources. What should the manager do?

Create a report of all cases and manually review them.

Use the search and filter options to display cases with status 'open' and severity 'high'.

Sort cases by severity and then by status.

Ask each analyst to report their open high-severity cases.

ElasticCertified SIEM Analyst

Domain 6Objective 6

Track Security Issues Using Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 4)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

36questions here

8free pages

9concepts

Questions 16–20

16expert · hard
An analyst has a large PCAP file (500 MB) that is critical evidence. The team has a policy to keep case attachments under 100 MB. What should the analyst do?
Select an answer first
17foundation · easy
Which of the following is an example of a file attachment that could be added to a case?
Select an answer first
18application · medium
A case is open for a malware outbreak. The analyst finds a new alert that is related to the same malware. What should the analyst do?
Select an answer first
19foundation · easy
In Elastic Security, what can a case be assigned to?
Select an answer first
20application · medium
A SOC manager wants to review all cases that are currently open and have a severity of 'high' to prioritize resources. What should the manager do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.