Track Security Issues Using Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An analyst is working on a case and has completed the initial triage. The analyst needs to indicate that work is actively being done. What status should the analyst set?

   • AIn-progress
   • BClosed
   • CPending
   • DOpen
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the purpose of the search and filter functionality on the Cases page?

   • ATo permanently delete cases
   • BTo create new detection rules
   • CTo modify Elasticsearch settings
   • DTo quickly locate specific cases based on criteria
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which fields can be updated on an existing case in Elastic Security?

   • ATitle, description, severity, and status
   • BElasticsearch cluster settings
   • CDetection rule actions and connectors
   • DIndex patterns and timestamp fields
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a common filter criterion for cases in Elastic Security?

   • ACluster health
   • BStatus
   • CData node count
   • DIndex size
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During a long investigation, an analyst wants to record a timeline of actions taken. What is the best way to document this in the case?

   • AAdd comments at each step with timestamps.
   • BUpdate the case title with each action.
   • CChange the case status after each action.
   • DAttach a document with the timeline.
   Reveal Solution Discussion Select an answer first