Elastic SIEM Analyst Practice Questions & Exam Guide

Elastic Certified SIEM Analyst is a security-operations route for candidates who use Elastic Security to triage alerts, investigate endpoint and network evidence, build timelines, manage cases, and reason through detection and threat-hunting workflows.

Use this page to try original IT Mastery sample questions on SIEM decisions. They are not official Elastic exam questions.

What these questions test

• triaging Elastic Security alerts using host, user, process, network, and timeline evidence
• deciding when detections need tuning, escalation, or additional investigation
• using cases and timelines to preserve reasoning and handoff context
• pairing objective readiness questions with hands-on Elastic Security workflows

Sample Exam Questions

Question 1

Topic: alert triage

An alert shows suspicious PowerShell with encoded command text, outbound network activity, and a rare parent process. What should the analyst do first?

• A. Treat it as suspicious, preserve evidence, add related events to a timeline, and review host and user context
• B. Close it because PowerShell is a Microsoft tool
• C. Delete endpoint data
• D. Disable all detections

Best answer: A

Explanation: Multiple suspicious indicators justify investigation. The analyst should preserve evidence and correlate host, user, process, and network context.

Question 2

Topic: timelines

Why add related events to a timeline?

• A. To delete the original alert
• B. To prove attribution automatically
• C. To organize evidence, sequence activity, support investigation reasoning, and improve handoff
• D. To hide unrelated alerts

Best answer: C

Explanation: Timelines help analysts connect related events and explain what happened. They support handoff and review.

Question 3

Topic: detection rules

A rule fires frequently on an approved admin script. What should be considered?

• A. Disabling every detection
• B. Tuning the rule with script path, signer, host group, schedule, or exception criteria while preserving unexpected matches
• C. Deleting the script without business review
• D. Ignoring all endpoint alerts

Best answer: B

Explanation: Tuning should reduce expected noise without hiding real misuse. Exceptions should be scoped and reviewed.

Question 4

Topic: endpoint data

Which endpoint fields are most useful when investigating suspicious process execution?

• A. Monitor brightness
• B. Dashboard title
• C. User favorite color
• D. Process command line, parent process, user, host, timestamp, file hash, path, and network connections

Best answer: D

Explanation: Process lineage, command line, user, host, hash, and network context help determine whether execution is suspicious.

Question 5

Topic: cases

When should an analyst create or update a case?

• A. When evidence, tasks, ownership, notes, or escalation need to be tracked beyond one alert
• B. Only after every alert is closed
• C. Never, because alerts are enough
• D. Only for dashboard errors

Best answer: A

Explanation: Cases support workflow, ownership, notes, and task tracking. They are useful when investigation needs coordination or follow-up.

Question 6

Topic: threat hunting

A hunt looks for unusual outbound connections from servers that normally do not access the internet. What data is most relevant?

• A. The company cafeteria menu
• B. Dashboard CSS
• C. Network events, host role context, destination reputation, volume, timing, and process responsible for the connection
• D. User profile photos

Best answer: C

Explanation: The hunt needs network, host, destination, process, and timing evidence. Host role context makes “unusual” meaningful.

Question 7

Topic: user context

Why include user context in endpoint investigations?

• A. Users are never relevant
• B. The user’s role, privilege, normal behavior, and recent sign-in activity can change risk and response decisions
• C. User context proves malware
• D. User names should always be hidden from analysts

Best answer: B

Explanation: User context helps determine impact and likelihood. Privileged users or unusual behavior can raise urgency.

Question 8

Topic: escalation

Which finding most strongly supports escalation?

• A. One known scanner event during an approved window
• B. A dashboard with no data because of a wrong time picker
• C. A user typo in a search query
• D. Confirmed credential theft indicators, privileged account use, suspicious process execution, and outbound communication

Best answer: D

Explanation: Multiple indicators involving credentials, privilege, execution, and network activity raise confidence and impact.

Question 9

Topic: investigation notes

What should good investigation notes include?

• A. Evidence reviewed, reasoning, decisions, actions taken, unresolved questions, and recommended next steps
• B. Only the alert title
• C. Personal guesses with no evidence
• D. No timestamps

Best answer: A

Explanation: Notes make the investigation inspectable and transferable. They should explain both evidence and reasoning.

Question 10

Topic: false positives

A detection is accurate but creates too many low-value alerts. What should be reviewed?

• A. Only the detection name
• B. Whether all alerts should be deleted
• C. Severity, threshold, scope, exception criteria, risk context, and whether the detection is actionable
• D. The user’s browser zoom

Best answer: C

Explanation: Detections should be actionable. Tuning can preserve useful findings while reducing noise.

Question 11

Topic: entity risk

Why combine host and user risk context?

• A. It proves every alert is malicious
• B. It helps analysts prioritize entities that show repeated or severe suspicious behavior across multiple signals
• C. It replaces evidence review
• D. It guarantees remediation

Best answer: B

Explanation: Entity risk can highlight patterns across alerts. It supports prioritization but does not replace analyst judgment.

Question 12

Topic: response coordination

Before isolating a critical server, what should be considered?

• A. Dashboard colors
• B. The length of the server name
• C. Whether logs can be deleted
• D. Business impact, approval path, evidence preservation, containment need, and communication with responsible teams

Best answer: D

Explanation: Containment actions can affect business services. Analysts should balance urgency, evidence, authorization, and communication.

Quick readiness checklist

Related IT Mastery pages

• Elastic Certified Observability Engineer for incident-signal and service-health workflows
• Splunk Cybersecurity Defense Analyst for SIEM route comparison
• GIAC GCIH for incident-response decisions
• CompTIA CySA+ for security-analyst practice