PracticeVideosBlogFlashcardsEspañol
All Practice Exams

156+ Free Elastic Certified SIEM Analyst Practice Questions

Prepare for the Elastic Certified SIEM Analyst exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
156+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More Elastic Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

Elastic Certified Engineer

Practice Questions

Elastic Certified Analyst

Practice Questions

Elastic Certified Observability Engineer

Practice Questions
2026 Statistics

Key Facts: Elastic Certified SIEM Analyst Exam

$400

Exam Fee per Attempt (USD)

Elastic Certification FAQ

Cognitive (MCQ)

Exam Format

Elastic (knowledge-based, not performance-based)

2 years

Credential Validity

Elastic Certification FAQ

Not published

Passing Score

Elastic does not publish a public passing score

7 rule types

Elastic Security Detection Rule Types

Elastic Security documentation

Honorlock

Remote Proctoring

Elastic Certification FAQ

The Elastic Certified SIEM Analyst is a timed cognitive (knowledge-based) exam from Elastic, costing $400 USD per attempt and remotely proctored via Honorlock, with the badge valid 2 years. Elastic does not publish a passing score or question count; the exam uses multiple choice, select all that apply, fill in the blanks, and true/false items. It covers SIEM fundamentals and Elastic Security architecture, ECS data ingestion and normalization, detection engineering across seven rule types with tuning, alert triage and investigation in Timelines and Cases, event correlation, enrichment and threat intelligence, RBAC, and security visualization.

Sample Elastic Certified SIEM Analyst Practice Questions

Try these sample questions to test your Elastic Certified SIEM Analyst exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 156+ question experience with AI tutoring.

1In Elastic Security, which component is responsible for evaluating detection rules on a schedule and generating alerts when matching events are found?
A.The detection engine
B.Logstash pipeline
C.Beats modules
D.The Kibana Discover app
Explanation: The detection engine in Elastic Security runs detection rules on a configurable schedule against indices, and when a rule's query matches events it creates alerts in the .alerts-security.alerts index. It is the core SIEM analytics component that turns rules into alerts.
2What does the acronym SIEM stand for in the context of Elastic Security?
A.Security Indexing and Event Mapping
B.Security Information and Event Management
C.System Information and Endpoint Management
D.Signal Intelligence and Event Monitoring
Explanation: SIEM stands for Security Information and Event Management. Elastic Security provides SIEM capabilities by centralizing log and event data, applying detection rules, and supporting investigation and response workflows.
3Within the Elastic Stack, which product provides the user interface where the Elastic Security SIEM app, dashboards, and Timelines are accessed?
A.Elasticsearch
B.Logstash
C.Kibana
D.Beats
Explanation: Kibana is the visualization and management layer of the Elastic Stack, and the Elastic Security app (SIEM) runs inside Kibana. Analysts use Kibana to view alerts, build Timelines, manage detection rules, and open dashboards.
4Which index pattern stores detection alerts generated by Elastic Security detection rules in a given Kibana space?
A..kibana-event-log-<version>
B..monitoring-es-<version>-mb
C..siem-signals-<space-name>
D..alerts-security.alerts-<space-id>
Explanation: Detection alerts are written to the .alerts-security.alerts-<space-id> index pattern, which is scoped to the Kibana space that produced them. This replaced the older .siem-signals-* naming and is the index pattern that detections privileges must grant access to.
5An analyst wants to monitor and respond to host-based threats with endpoint prevention and response. Which Elastic integration provides endpoint protection that feeds telemetry into Elastic Security?
A.Elastic APM
B.Elastic Maps
C.Elastic Defend
D.Elastic Enterprise Search
Explanation: Elastic Defend is the endpoint security integration deployed through Elastic Agent. It collects host telemetry (processes, files, network, registry), provides malware and ransomware prevention, and supports response actions like isolating a host.
6On the Elastic Security Explore page, which prebuilt dashboards are instantly populated with ingested data to give an analyst situational awareness?
A.Uptime, Synthetics, and Logs
B.Fleet, Agents, and Policies
C.Discover, Canvas, and Vega
D.Hosts, Network, and Users
Explanation: The Explore section of Elastic Security includes prebuilt Hosts, Network, and Users pages. These dashboards summarize entity activity, network flows, and authentication events to help analysts triage and pivot during investigations.
7Which statement best describes the purpose of a SIEM such as Elastic Security?
A.To centralize and analyze security data for detection
B.To replace firewalls and antivirus as the only security control
C.To store nightly backups of production databases
D.To provide CI/CD pipeline automation for developers
Explanation: A SIEM aggregates logs and events from many sources, normalizes them to a common schema, applies detection logic, and supports investigation and response. Elastic Security delivers those capabilities on top of the Elastic Stack.
8In Elastic Security, where are detection rules, Timelines, Cases, and alerts logically isolated so that one team's data is not visible to another?
A.Index lifecycle policies
B.Kibana spaces
C.Ingest pipelines
D.Runtime fields
Explanation: Each Kibana space represents a separate logical instance of Elastic Security. Detection rules, exceptions, value lists, alerts, Timelines, and Cases are private to the space and accessible only to users with privileges for that space.
9Which of the following is the central workspace in Elastic Security for deep investigation and threat hunting, where an analyst can build complex queries and correlate events?
A.Stack Monitoring
B.Timeline
C.Dev Tools Console
D.Index Management
Explanation: Timeline is the central investigation and threat-hunting workspace in Elastic Security. Analysts add alerts and events from multiple indices, query with KQL, EQL, or ES|QL, and pivot across hosts, users, and network activity to reconstruct an event sequence.
10Elastic Security maps its detection rules to a widely used adversary behavior framework so analysts can identify coverage gaps. Which framework is this?
A.OWASP Top 10
B.NIST CSF
C.MITRE ATT&CK
D.PCI DSS
Explanation: Elastic Security maps prebuilt and custom detection rules to MITRE ATT&CK tactics and techniques. The MITRE ATT&CK coverage page lets analysts visualize which techniques are covered and find detection gaps.

About the Elastic Certified SIEM Analyst Exam

The Elastic Certified SIEM Analyst exam validates an analyst's ability to operate Elastic Security as a SIEM. Unlike Elastic's performance-based exams, it is a timed cognitive (knowledge-based) exam with multiple choice, select-all, fill-in-the-blank, and true/false questions. The blueprint spans SIEM fundamentals and Elastic Security architecture; data ingestion and normalization to the Elastic Common Schema (ECS) using Elastic Agent and Fleet integrations; detection engineering across the seven rule types (custom query, EQL, threshold, indicator match, new terms, ES|QL, and machine learning) including exceptions, suppression, and tuning; alert triage and investigation with Timelines and Cases; event correlation and incident analysis; enrichment and threat intelligence with indicator match rules; role-based access control with Kibana feature privileges and spaces; and visualization of security data with Lens, Maps, and entity analytics.

Assessment

Question count not published by the exam provider

Time Limit

Not published (timed exam)

Passing Score

Not publicly published by Elastic

Exam Fee

$400 (Elastic)

Elastic Certified SIEM Analyst Exam Content Outline

Not published

Stack Overview

Elastic Stack architecture, Elasticsearch/Kibana roles and Elastic Security solution context (course module 1)

Not published

Elastic Common Schema (ECS)

ECS field conventions, normalization of security data, integrations and Fleet/Elastic Agent onboarding (module 2)

Not published

Discover

Searching and filtering security data with KQL/Lucene, data views and field exploration (module 3)

Not published

Visualizations

Building visualizations of security data (module 4)

Not published

Lens

Lens visualization workflows (module 5)

Not published

Dashboards

Assembling and sharing security dashboards (module 6)

Not published

Security App / SIEM

Detection engine and rule types, prebuilt rules, exceptions, alerts, Timelines, Cases, ES|QL, AI Assistant and Attack Discovery, privileges (module 7)

Not published

Hunt Capstone

End-to-end threat-hunting exercise across the stack (module 8)

How to Pass the Elastic Certified SIEM Analyst Exam

What You Need to Know

  • Passing score: Not publicly published by Elastic
  • Assessment: Question count not published by the exam provider
  • Time limit: Not published (timed exam)
  • Exam fee: $400

Keys to Passing

  • Work through all 156 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

Elastic Certified SIEM Analyst Study Tips from Top Performers

1Master the seven detection rule types and exactly when to use each: custom query for single events, EQL for ordered sequences and absence, threshold for counts, indicator match for IOC feeds, new terms for first-seen values, ES|QL for aggregation, and machine learning for anomalies.
2Get fluent in ECS field names (source.ip, destination.ip, host.name, user.name, event.category, event.type, event.outcome, dns.question.name, file.hash.sha256); prebuilt rules and dashboards all depend on correct ECS normalization.
3Practice tuning workflows hands-on: rule exceptions, value lists, shared exception lists, alert suppression, rule preview, and adjusting look-back time to avoid coverage gaps.
4Know the investigation flow end to end: alert status and assignment, investigating in Timeline, the process analyzer and Session View, and documenting and escalating in Cases with Jira/ServiceNow/IBM Resilient connectors.
5Understand RBAC precisely: the single Kibana Security feature privilege (All or Read) plus read or write privileges on the alerts indices decide who can view, create, and manage rules and alerts; the only sub-feature privileges in 8.15 are Elastic Defend ones; Kibana spaces isolate rules, alerts, Timelines, and cases between teams.
6Drill enrichment and threat intelligence: geoip and enrich processors, asset criticality, threat-intel integrations populating indicator indices, and indicator match rules detecting known-bad IPs, domains, URLs, and hashes.

Frequently Asked Questions

What format is the Elastic Certified SIEM Analyst exam?

It is a timed cognitive (knowledge-based) exam, not performance-based. It uses multiple choice, select all that apply, fill in the blanks, and true/false questions focused on the Elastic Security solution, and is remotely proctored through Honorlock.

What does the Elastic SIEM Analyst exam cost and how long is the badge valid?

Elastic lists the SIEM Analyst exam at $400 USD per attempt, and Elastic credentials are valid for 2 years from the exam date, after which recertification is required.

What is the passing score and question count?

Elastic does not publish a passing score, a question count, or a time limit for the SIEM Analyst exam; its certification FAQ describes only the cognitive format and the $400 per-attempt fee.

How is this exam different from the Elastic Certified Analyst exam?

The Elastic Certified Analyst exam is performance-based and centered on Kibana data analysis, while the SIEM Analyst exam is a cognitive exam centered on the Elastic Security solution, including detection rules, Timelines, Cases, and threat intelligence.

Which topics carry the most weight?

Detection engineering, including creating and tuning the seven rule types and reducing false positives, is the heaviest area. Data ingestion and ECS normalization is also significant because prebuilt rules depend on ECS fields.

What are the seven Elastic detection rule types I must know?

Custom query, event correlation (EQL), threshold, indicator match, new terms, ES|QL, and machine learning. Knowing when to choose each, plus exceptions, value lists, and alert suppression for tuning, is essential.