I85PREP
⌘ K
Elastic Certified SIEM Analyst study materials
Elastic Certified SIEM Analyst study resources

Elastic Certified SIEM Analyst practice questions

One question at a time. Build your Elastic Certified SIEM Analyst understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Elastic Security architecture, deployment, and cluster/space configuration

A detection rule is created in the Default space. What happens to that rule in a newly created space?

  1. It is not visible there by default. Correct answer.
  2. It runs automatically in the new space as well.
  3. It is deleted from the Default space.
  4. It becomes read-only in the Default space.

Explanation

Kibana spaces isolate saved objects, including detection rules. A rule created in one space is not automatically available in another space; it must be shared, copied, or recreated there.

Question 2Elastic Security architecture, deployment, and cluster/space configuration

An Elasticsearch cluster reports health status yellow. What does this indicate?

  1. Primaries are assigned; some replicas are not. Correct answer.
  2. The cluster is unavailable for searches.
  3. All primary and replica shards are assigned.
  4. Some primary shards are unassigned.

Explanation

Yellow means all primary shards are allocated, but at least one replica shard is unassigned. Searches still work, but redundancy is reduced. Red status would indicate unassigned primary shards, and green means all shards are assigned.

Question 3Elastic Security architecture, deployment, and cluster/space configuration

Which port does Elasticsearch use by default for node-to-node transport communication?

  1. 9200
  2. 9300 Correct answer.
  3. 9243
  4. 5601

Explanation

Elasticsearch uses port 9300 for the internal transport protocol between cluster nodes. Port 9200 is the default HTTP/REST interface used by clients such as Kibana and Elastic Agent.

Question 4Elastic Security architecture, deployment, and cluster/space configuration

An Elastic Agent is enrolled in Fleet to receive centrally managed policies. Which component must it connect to for enrollment and policy updates?

  1. An APM Server
  2. A Fleet Server Correct answer.
  3. A Kibana instance only
  4. A Logstash pipeline

Explanation

Fleet-managed Elastic Agents enroll with and check in to a Fleet Server, which distributes policies and coordinates agent status. Kibana provides the Fleet management UI, but agents communicate with Fleet Server for enrollment and updates.

Question 5Elastic Security architecture, deployment, and cluster/space configuration

Which built-in Kibana role provides read-only access to Kibana features?

  1. editor
  2. viewer Correct answer.
  3. kibana_admin
  4. superuser

Explanation

The built-in viewer role grants read-only access to Kibana and its saved objects. The editor role can create and modify objects, while kibana_admin and superuser have broader administrative privileges.

Question 6Elastic Security architecture, deployment, and cluster/space configuration

Where does Elasticsearch store the data written during a snapshot operation?

  1. In a registered snapshot repository Correct answer.
  2. In the detection alerts index
  3. In the Kibana saved objects index
  4. In the Fleet Server cache

Explanation

Snapshots are written to a snapshot repository registered with the cluster, such as a shared filesystem, S3, or another supported storage backend. The repository must be registered and accessible to all relevant nodes.

Question 7Elastic Security architecture, deployment, and cluster/space configuration

Which Elasticsearch node role is required to run machine learning anomaly detection jobs?

  1. data_hot
  2. ml Correct answer.
  3. transform
  4. ingest

Explanation

Machine learning anomaly detection jobs require at least one node with the ml role. Data and ingest roles serve different purposes, and transform is used for pivot and latest transforms rather than ML job execution.

Question 8Elastic Security architecture, deployment, and cluster/space configuration

Detection rules in Elastic Security execute as background tasks in which component?

  1. Fleet Server
  2. Endpoint
  3. Kibana Correct answer.
  4. Elasticsearch ingest pipelines

Explanation

Detection rules are scheduled and executed by Kibana's alerting framework as background tasks. Elasticsearch stores the data and alerts, but rule scheduling and query execution are driven by Kibana.

Question 9Elastic Security architecture, deployment, and cluster/space configuration

Why are dedicated master-eligible nodes commonly used in a production Elasticsearch cluster?

  1. They store the most recent alerts.
  2. They terminate TLS for agents.
  3. They run detection rule queries.
  4. They manage cluster state and quorum. Correct answer.

Explanation

Master-eligible nodes maintain cluster state and participate in master election quorum. Dedicated master nodes avoid competing with data or ingest workloads, improving cluster stability.

Question 10Elastic Security architecture, deployment, and cluster/space configuration

A Fleet Server is deployed as an Elastic Agent. Which enrollment mode does it use?

  1. Fleet-managed mode, control plane Correct answer.
  2. APM mode collecting traces
  3. Endpoint mode with malware protection
  4. standalone mode with a local policy

Explanation

Fleet Server is an Elastic Agent enrolled in Fleet-managed mode that acts as the control plane for other agents. It receives its own policy from Fleet and coordinates enrollment and check-ins for agent fleets.

Question 11Elastic Security architecture, deployment, and cluster/space configuration

Which certificate is used to secure node-to-node communication in an Elasticsearch cluster?

  1. API key
  2. Fleet enrollment token
  3. Transport layer certificate Correct answer.
  4. HTTP CA certificate used for Kibana

Explanation

Transport TLS certificates secure the internal transport protocol between Elasticsearch nodes. HTTP TLS certificates are used for client-facing REST connections, while tokens and API keys are credentials rather than certificates.

Question 12Elastic Security architecture, deployment, and cluster/space configuration

A role should let a user open the Security app in one space but not view Dashboards there. Which configuration controls this?

  1. Space feature privileges Correct answer.
  2. A remote cluster
  3. A snapshot repository
  4. Index lifecycle policies

Explanation

Space feature privileges determine which Kibana features, such as Security or Dashboards, are visible to a role within a space. Index policies, repositories, and remote clusters do not control Kibana feature visibility.

Question 13Elastic Security architecture, deployment, and cluster/space configuration

A custom role must allow a user to use Security in a space and read logs-* indices. Which combination is required?

  1. Only cluster monitor privilege
  2. Feature and index privileges Correct answer.
  3. Only a snapshot policy
  4. Only a Fleet enrollment token

Explanation

Kibana feature privileges grant access to Security features, while index privileges grant read access to the underlying log data. Both are needed because feature access alone does not authorize reading indices.

Question 14Elastic Security architecture, deployment, and cluster/space configuration

Which node role must be present for a node to connect to remote clusters for cross-cluster search?

  1. ml anomaly node
  2. voting_only master node
  3. remote_cluster_client Correct answer.
  4. ingest node with pipelines

Explanation

The remote_cluster_client role allows a node to act as a client to remote clusters. Nodes handling cross-cluster search need this role so they can communicate with the configured remote cluster.

Question 15Elastic Security architecture, deployment, and cluster/space configuration

Elastic Agent integrations such as system logs typically write data into what Elasticsearch structure?

  1. The .kibana index
  2. A single static index
  3. Data streams managed by ILM Correct answer.
  4. A snapshot repository

Explanation

Fleet integrations commonly write to data streams, which are composed of backing indices and managed by index lifecycle management. This supports rollover and retention without manual index creation.

Question 16Elastic Security architecture, deployment, and cluster/space configuration

How do Fleet-managed Elastic Agents authenticate to the Elasticsearch output by default?

  1. Basic auth with elastic superuser
  2. Anonymous access
  3. API keys issued by Fleet Correct answer.
  4. SAML assertion

Explanation

Fleet issues API keys for agent policies and outputs so agents can write data without embedding human credentials. The API keys are scoped to the permissions required by the integration policy.

Question 17Elastic Security architecture, deployment, and cluster/space configuration

Detection alerts generated in a custom Kibana space are stored in which index?

  1. The Fleet Server index
  2. A snapshot repository
  3. A per-space alerts index Correct answer.
  4. The main logs index

Explanation

Elastic Security writes alerts to a space-specific alerts index, following the pattern .alerts-security.alerts-<space>. This keeps alert data isolated according to the space in which the rule runs.

Question 18Elastic Security architecture, deployment, and cluster/space configuration

Which component executes action connectors such as email or Slack notifications for Security alerts?

  1. The endpoint agent
  2. Elasticsearch ingest nodes
  3. Fleet Server
  4. Kibana Correct answer.

Explanation

Action connectors are part of Kibana's alerting framework, which runs the connector when a rule generates an alert. Elasticsearch stores alert data, but Kibana performs the external notification action.

Question 19Elastic Security architecture, deployment, and cluster/space configuration

Prebuilt detection rules are written to work with data that follows which schema?

  1. A proprietary schema
  2. Only NetFlow records
  3. The Elastic Common Schema Correct answer.
  4. Only Windows event logs

Explanation

Prebuilt rules expect fields normalized to the Elastic Common Schema so that queries work across data sources. Integrations that map fields to ECS are therefore the best fit for prebuilt rule coverage.

Question 20Elastic Security architecture, deployment, and cluster/space configuration

Host isolation and malware response actions from Elastic Security require which component on the host?

  1. A snapshot repository
  2. An APM agent
  3. Defend installed on the host Correct answer.
  4. A Logstash pipeline with filters

Explanation

Response actions such as host isolation and malware investigation rely on the Elastic Defend endpoint integration. The endpoint must be installed and healthy so it can receive and execute response commands.

Question 21Elastic Security architecture, deployment, and cluster/space configuration

When a detection rule is enabled in Kibana, which credential is used to run its queries?

  1. An anonymous key with no privileges
  2. The elastic superuser password stored in plain text
  3. An API key generated for the user enabling the rule Correct answer.
  4. The Fleet enrollment token

Explanation

Kibana creates an API key associated with the user who enables the rule, and the rule uses that key when querying data. The enabling user therefore needs sufficient privileges to read the rule's target indices.

Question 22Elastic Security architecture, deployment, and cluster/space configuration

A detection rule must query indices on a remote cluster. What is required on the remote side for cross-cluster search to succeed?

  1. A snapshot repository shared with the local cluster
  2. A remote cluster connection and cross-cluster key Correct answer.
  3. An ingest pipeline named remote
  4. A second Kibana instance

Explanation

Cross-cluster search requires a remote cluster connection on the local cluster and authorization on the remote cluster. A cross-cluster API key with the appropriate index privileges lets the local cluster read remote indices.

Question 23Elastic Security architecture, deployment, and cluster/space configuration

For high availability, multiple Fleet Servers are usually deployed in which way?

  1. Assigned the ml node role
  2. Behind a load balancer with a shared certificate Correct answer.
  3. Configured with separate output indices per server
  4. Enrolled to different Kibana spaces

Explanation

Multiple Fleet Servers are typically placed behind a load balancer and share the same certificate so agents use a single enrollment URL. This provides redundancy if one Fleet Server becomes unavailable.

Question 24Elastic Security architecture, deployment, and cluster/space configuration

Which mechanism controls retention and rollover for detection alert indices in a custom space?

  1. A new Fleet Server
  2. A dedicated master node
  3. An ILM policy on the alerts index Correct answer.
  4. A separate Elasticsearch cluster

Explanation

Alert indices are managed through index lifecycle management, which handles rollover, retention, and deletion according to policy. A custom space's alerts index needs an applicable ILM policy to control its lifecycle.

Question 25Elastic Security architecture, deployment, and cluster/space configuration

Which setting enables Elasticsearch's native security features, including authentication and TLS configuration?

  1. cluster.routing.allocation.enable
  2. discovery.type: single-node
  3. xpack.security.enabled: true Correct answer.
  4. xpack.ml.enabled: true

Explanation

The xpack.security.enabled setting activates Elasticsearch security features such as authentication, authorization, and TLS configuration. The other settings control machine learning, shard allocation, and node discovery respectively.

Question 26Elastic Security architecture, deployment, and cluster/space configuration

Which Kibana capability lets one deployment serve separate sets of saved objects, such as dashboards and detection rules, to different teams?

  1. API keys scoped to an index pattern
  2. Spaces Correct answer.
  3. Index templates managed by Fleet
  4. Role mappings defined in Elasticsearch

Explanation

Spaces partition Kibana saved objects so that objects created in one space are not visible in another unless they are explicitly shared or copied. A user's access to each space is granted through role privileges that carry a space selector, so the space itself provides the container and the role provides the permission.

Question 27Elastic Security architecture, deployment, and cluster/space configuration

An Elasticsearch cluster reports a health status of yellow. What does this indicate?

  1. All primaries are allocated, but at least one replica shard is unassigned. Correct answer.
  2. No shards are allocated, so searches and indexing fail.
  3. Every primary and replica shard is allocated and the cluster is healthy.
  4. The cluster has lost its elected master and cannot process requests.

Explanation

Cluster health is derived from shard allocation: green means all primaries and replicas are assigned, yellow means all primaries are assigned but at least one replica is not, and red means at least one primary is unassigned. A yellow cluster still serves searches and indexing because every primary shard has a home, but it has reduced redundancy.

Question 28Elastic Security architecture, deployment, and cluster/space configuration

Which node role is responsible for storing shard data and running the queries that search it?

  1. data Correct answer.
  2. ml
  3. ingest
  4. voting_only

Explanation

Nodes with the data role hold primary and replica shards and execute the search and indexing work for those shards. Other roles add capabilities around that work rather than replacing it, which is why production clusters scale capacity by adding data nodes.

Question 29Elastic Security architecture, deployment, and cluster/space configuration

In an index lifecycle policy, what does the rollover action do?

  1. It converts an index into a snapshot stored in the repository.
  2. It redirects writes to a new index when the rollover criteria are met. Correct answer.
  3. It merges the index's small segments together to reduce storage overhead.
  4. It deletes the current index once it reaches the maximum age.

Explanation

Rollover compares the current write index against thresholds such as maximum age, size, or document count, and when one is exceeded it creates a new index and points the data stream or alias at it. The previous index becomes read-only for writes and continues through the later lifecycle phases.

Question 30Elastic Security architecture, deployment, and cluster/space configuration

What is the primary function of a coordinating-only node?

  1. It routes client requests to the right shards and merges their results. Correct answer.
  2. It runs ingest pipelines before documents are indexed.
  3. It elects the cluster master and maintains the cluster state.
  4. It stores replica shards for indices whose primaries live on other nodes.

Explanation

A coordinating-only node has no data, master-eligible, or ingest duties, so its work is limited to receiving client requests, fanning them out to the shards that hold the data, and reducing the responses into a single result. This role is typically added to absorb heavy search or bulk traffic without affecting data or master stability.

Question 31Elastic Security architecture, deployment, and cluster/space configuration

In Fleet, what does an agent policy determine?

  1. Which integrations an Elastic Agent runs and which output it sends data to. Correct answer.
  2. Which users are allowed to log in to Kibana.
  3. Which TLS certificate the agent presents to Fleet Server.
  4. Which Elasticsearch index templates are created for each integration.

Explanation

An agent policy bundles the integrations, their settings, and the output configuration that an enrolled Elastic Agent should apply. When the policy is updated in Kibana, enrolled agents receive the change on their next check-in and reconfigure themselves accordingly.

Question 32Elastic Security architecture, deployment, and cluster/space configuration

To keep copies of each shard on separate racks, which configuration should be applied?

  1. Enable shard allocation filtering based on node names.
  2. Assign the data role to every node in the cluster.
  3. Set cluster.routing.allocation.awareness.attributes to a rack attribute. Correct answer.
  4. Increase index.number_of_replicas above the number of racks in use.

Explanation

Allocation awareness uses a node attribute such as a rack or zone identifier to spread shard copies across distinct values of that attribute, so a single rack failure cannot take out every copy of a shard. Adding a forced-awareness setting additionally stops allocation when the required number of attribute values is not available.

Question 33Elastic Security architecture, deployment, and cluster/space configuration

A cluster runs three master-eligible nodes with default settings. One master-eligible node fails and cannot be recovered immediately. What is the outcome?

  1. Elasticsearch automatically promotes a data node to a master-eligible node.
  2. The cluster state becomes read-only until the failed node is restored.
  3. The remaining two nodes retain quorum and continue to update cluster state. Correct answer.
  4. The remaining two nodes cannot elect a master and the cluster stops serving requests.

Explanation

Master elections require a quorum, which is a majority of the master-eligible nodes; for three nodes that majority is two. With one node down, the surviving pair still forms a quorum and can elect a master and publish cluster state changes, though the cluster loses its ability to tolerate a second failure.

Question 34Elastic Security architecture, deployment, and cluster/space configuration

Users authenticate to Kibana through a SAML realm. Which mechanism grants them Elasticsearch roles?

  1. Roles come from the index privileges of the Kibana space the user opens.
  2. A role mapping matches SAML attributes and assigns roles to matching users. Correct answer.
  3. Kibana copies roles from the identity provider into the .kibana index at login.
  4. Roles are listed per user in the SAML realm settings in elasticsearch.yml.

Explanation

When a realm such as SAML authenticates a user, Elasticsearch resolves that user's roles through role mappings that evaluate the assertion attributes returned by the identity provider. Without a matching role mapping the user authenticates successfully but receives no privileges, which is why mappings must be defined for each intended role.

Question 35Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

A data stream is named logs-nginx.access-default. What does the final segment (default) identify?

  1. The namespace Correct answer.
  2. The data stream type
  3. The dataset
  4. The integration version

Explanation

Data stream names follow the pattern {type}-{dataset}-{namespace}. Here the type is logs, the dataset is nginx.access, and the trailing segment is the namespace used to separate data from different environments or sources.

Question 36Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

Which ECS field stores the primary timestamp of an event and is used as Kibana's default time field?

  1. event.created
  2. timestamp
  3. event.timestamp
  4. @timestamp Correct answer.

Explanation

ECS defines @timestamp as the date and time at which an event occurred, and Kibana data views use it as the default time field. Other date fields such as event.created and event.start are supplementary.

Question 37Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

Which component distributes agent policies and manages Elastic Agents centrally in the Elastic Stack?

  1. A Beats central manager
  2. Fleet Correct answer.
  3. A Logstash pipeline
  4. Kibana Dev Tools

Explanation

Fleet is the management layer in Kibana that creates agent policies, enrolls agents, and tracks their status. Agents connect through a Fleet Server to receive policy updates and report health.

Question 38Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

What is the Elastic Common Schema (ECS)?

  1. A shared field naming standard Correct answer.
  2. A pipeline scripting language
  3. A set of prebuilt dashboards
  4. A binary log shipping format

Explanation

ECS is a documented set of field names and values that lets data from many sources be searched, correlated, and visualized consistently. Integrations map their fields to ECS wherever an equivalent exists.

Question 39Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

What must an Elastic Agent present in order to enroll with a Fleet Server?

  1. A Logstash pipeline ID
  2. A Kibana service account
  3. A snapshot repository name
  4. An enrollment token Correct answer.

Explanation

Fleet issues enrollment tokens that authorize an agent to enroll and receive its policy. Tokens can be scoped to a specific agent policy and invalidated after use.

Question 40Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

Which ECS field holds the IP address of the system that received a network connection?

  1. destination.ip Correct answer.
  2. observer.ip
  3. host.ip
  4. network.destination.ip

Explanation

In ECS network events, destination.* describes the receiving side of a connection while source.* describes the initiating side. Address and port are expressed as destination.ip and destination.port.

Question 41Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

Which assets does an Elastic integration package typically install?

  1. A compiled Beats binary and its systemd unit
  2. Ingest pipelines, index templates, and dashboards Correct answer.
  3. A snapshot repository and an SLM policy
  4. A Logstash pipeline and a Kafka topic

Explanation

Integration packages bundle what is needed to collect, parse, store, and visualize a data source: ingest pipelines, index templates, ILM policies, Kibana dashboards, and the agent-side input configuration.

Question 42Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

In Fleet, what is an agent policy?

  1. A configuration file edited directly on each host
  2. A set of integrations assigned to agents Correct answer.
  3. A firewall rule set pushed to endpoints
  4. A saved search shared across Kibana spaces

Explanation

An agent policy groups one or more integration policies together with settings such as the output, and it is assigned to enrolled agents. Agents check in and apply the current version of that policy.

Question 43Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

A log record shows that a user authenticated successfully to a server. Which value should event.outcome carry?

  1. allowed
  2. success Correct answer.
  3. complete
  4. accepted

Explanation

ECS restricts event.outcome to a small allowed set: success, failure, and unknown. Words like accepted or allowed should be expressed in event.action or in a custom field instead.

Question 44Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

Which Elasticsearch object applies a sequence of processors to documents before they are indexed?

  1. An index template
  2. A component template
  3. An ingest pipeline Correct answer.
  4. An ILM policy

Explanation

Ingest pipelines run processors such as grok, dissect, rename, and set on documents in the ingest node before indexing. Templates and lifecycle policies govern index structure and retention, not document content.

Question 45Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

When adding the Custom Logs integration to an agent policy, which setting tells the agent which files to read?

  1. Pipeline name
  2. Log file paths Correct answer.
  3. Namespace
  4. Dataset name

Explanation

The Custom Logs integration accepts one or more filesystem paths or glob patterns in its log file paths setting. The agent then reads matching files and ships each line as an event tagged with the configured dataset and namespace.

Question 46Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

What physically stores the documents of a single Elasticsearch data stream?

  1. An ILM policy definition
  2. Hidden backing indices Correct answer.
  3. A snapshot repository
  4. A single index with an alias

Explanation

A data stream is a logical naming layer over one or more hidden backing indices. New documents go to the current write index, and additional backing indices are created as the stream rolls over.

Question 47Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

In a Fleet-managed deployment, where do Elastic Agents send status updates and policy check-ins?

  1. The Kibana saved objects API
  2. Fleet Server Correct answer.
  3. An Elasticsearch snapshot repository
  4. The Logstash monitoring API

Explanation

Agents maintain a connection to a Fleet Server, which relays policy updates, status, and actions between agents and Kibana. The Fleet Server in turn stores its state in Elasticsearch.

Question 48Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

An agent in Fleet shows a status of Healthy. What does that indicate?

  1. The agent is connected and its components are running Correct answer.
  2. The agent downloaded a policy that failed validation
  3. The agent has never checked in with Fleet Server
  4. The agent is partway through an upgrade

Explanation

Healthy means the agent is connected to Fleet Server and its running components report no problems. Offline means Fleet has stopped receiving check-ins, and Unhealthy means a component has reported an error.

Question 49Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

Which integration asset determines when a data stream's backing indices roll over or are deleted?

  1. The ILM policy linked by the index template Correct answer.
  2. The Kibana space settings
  3. The ingest pipeline
  4. The agent policy

Explanation

Integration index templates reference an ILM policy, and that policy defines rollover thresholds and the retention actions of each phase. The data stream inherits these settings from its template.

Question 50Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)

Which ECS field holds the name of the machine on which an event happened?

  1. agent.name
  2. observer.name
  3. device.name
  4. host.name Correct answer.

Explanation

The host.* field set describes the host where the event occurred, and host.name holds its name. The observer.* set instead describes the device that observed the event, such as a firewall or IDS.