A security team uses cases to manage incidents. A critical case is created during the night shift, and the on-call analyst needs to take ownership. What should the analyst do to ensure accountability?

Assign the case to themselves and update the status to 'in-progress'.

Add a comment indicating they are working on it.

Change the severity of the case to 'critical'.

Link the case to an alert to show activity.

A SOC team detects multiple alerts related to the same campaign. They want to manage these as one investigation. What is the best approach?

Create a separate case for each alert.

Create a case and link all related alerts to it.

Add comments to each alert to note the campaign.

Change the status of each alert to 'closed'.

A SOC analyst needs to find all cases assigned to them that are not yet closed. What is the most efficient way?

Scroll through all cases manually.

Ask other analysts for their open cases.

Create a report of all cases and filter in a spreadsheet.

Use search filters for assignee and status.

What is the benefit of linking an alert to a case in Elastic Security?

It associates related security events with the case for context

It automatically resolves the alert

It creates a new detection rule

It deletes the alert from the system

ElasticCertified SIEM Analyst

Domain 6Objective 6

Track Security Issues Using Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 5)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

36questions here

8free pages

9concepts

Questions 21–25

21application · medium
A security team uses cases to manage incidents. A critical case is created during the night shift, and the on-call analyst needs to take ownership. What should the analyst do to ensure accountability?
Select an answer first
22application · medium
A SOC team detects multiple alerts related to the same campaign. They want to manage these as one investigation. What is the best approach?
Select an answer first
23foundation · easy
Which of the following is a valid case status in Elastic Security?
Select an answer first
24application · medium
A SOC analyst needs to find all cases assigned to them that are not yet closed. What is the most efficient way?
Select an answer first
25foundation · easy
What is the benefit of linking an alert to a case in Elastic Security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.