Use Explore Within the Security App to View Security-Related Events ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   An analyst wants to see only events related to a specific host in the Explore page. What is the most direct way to accomplish this?

   • AExpand an event to view its details
   • BSort the data table by the host.name column
   • CChange the time range to the last hour
   • DApply a filter on the host.name field
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In the Explore interface, which component displays a visual representation of event counts over time?

   • AHistogram
   • BData table
   • CField panel
   • DFilter bar
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   An analyst needs to start reviewing security events in the Elastic Security app. Which navigation action should the analyst take first?

   • ANavigate to the Explore page within the Elastic Security app
   • BOpen the Kibana Discover page from the main navigation menu
   • COpen the Elastic Maps application to visualize event locations
   • DGo to the Elasticsearch Dev Tools console and run a search query
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What action should an analyst take to view all field values and metadata for a single event in the Explore data table?

   • ASort the table by timestamp
   • BChange the time range
   • CExpand the event row
   • DApply a filter on the event
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How can an analyst adjust the time range displayed in the histogram?

   • AModify the index pattern settings
   • BUse the time picker in the Explore interface
   • CApply a filter on the timestamp field
   • DChange the field panel configuration
   Reveal Solution Discussion Select an answer first