What is the purpose of updating a case's description?

To provide a detailed narrative of the security issue and investigation

To assign the case to a different user

To modify the associated Elasticsearch index

To change the case's unique identifier

An analyst is investigating a malware infection and has a sample of the malicious file. The analyst wants to preserve the sample as evidence in the case. What should the analyst do?

Add a comment describing the file.

Link the file's alert to the case.

Update the case description with the file name.

An analyst has a packet capture (PCAP) file that is crucial evidence for a case. What should the analyst do to make it available to the team?

Update the case description with the file name.

Attach the PCAP file to the case.

Add a comment with a link to the file.

Create a new case for the PCAP.

What is the purpose of attaching files to a case in Elastic Security?

To automatically update the case status

To provide supporting evidence and reference material

ElasticCertified SIEM Analyst

Domain 6Objective 6

Track Security Issues Using Cases ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 7)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

36questions here

8free pages

9concepts

Questions 31–35

31foundation · easy
What is the purpose of updating a case's description?
Select an answer first
32application · medium
An analyst is investigating a malware infection and has a sample of the malicious file. The analyst wants to preserve the sample as evidence in the case. What should the analyst do?
Select an answer first
33application · medium
An analyst has a packet capture (PCAP) file that is crucial evidence for a case. What should the analyst do to make it available to the team?
Select an answer first
34foundation · easy
What can be generated from case data to analyze resolution trends?
Select an answer first
35foundation · easy
What is the purpose of attaching files to a case in Elastic Security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.