ELASTIC-ANALYST Practice Test

ELASTIC-ANALYST practice test: what's covered

• Elasticsearch
• Kibana & KQL/ES|QL
• Dashboards & ECS
• Elastic Security Detections
• Timeline & Cases
• Threat Hunting & ATT&CK

Free ELASTIC-ANALYST sample questions

1. A new analyst describes Elasticsearch's data model. They want to confirm the unit that represents a single record (for example one log event) that is stored, indexed and returned in search hits. Which term is correct?

   • A. A document
   • B. An index
   • C. A shard
   • D. A mapping
   Show answer

   Correct: A. A document is the basic unit of information in Elasticsearch — a JSON object representing a single record. Documents live inside an index; an index is split into shards for distribution; mapping defines how fields are stored and analyzed.

2. An index was created with 3 primary shards and 1 replica. The cluster has three data nodes. How many shard copies exist in total for this index, and what does the replica provide?

   • A. 6 shards total — replicas provide redundancy and can serve read/search requests
   • B. 3 shards total — replicas only store backups and never serve searches
   • C. 4 shards total — 3 primaries plus 1 shared replica
   • D. 9 shards total — every node gets one full copy of each primary
   Show answer

   Correct: A. Replicas = 1 means each of the 3 primaries gets one replica copy, so 3 primaries + 3 replicas = 6 shards. Replica shards provide failover redundancy AND increase search throughput because they can serve read/search requests alongside primaries.

3. An admin needs a string field to be usable BOTH for full-text relevance search and for exact aggregations/sorting/keyword filtering. Which mapping approach satisfies both needs for the same source field?

   • A. Map it as type 'text' with a 'keyword' multi-field (the .keyword sub-field)
   • B. Map it only as 'keyword' and rely on wildcards for full-text search
   • C. Map it as 'text' only; aggregations work on text by default
   • D. Map it as 'integer' so it can be both searched and aggregated
   Show answer

   Correct: A. The standard pattern is a 'text' field (analyzed, for full-text search) with a 'keyword' multi-field for exact matching, sorting and aggregations. Aggregating/sorting on a raw analyzed 'text' field requires fielddata and is discouraged, which is why the .keyword sub-field exists.

4. When you index a document into Elasticsearch, where is the field-level information (analyzers, data types, whether a field is searchable/aggregatable) defined?

   • A. In the index mapping
   • B. In the document's _id field
   • C. In the Kibana data view only
   • D. In the cluster's elasticsearch.yml
   Show answer

   Correct: A. The mapping is the schema of an index: it defines each field's data type, analyzer, and properties like whether it is indexed, doc_values-enabled, etc. The Kibana data view is a separate Kibana abstraction over one or more indices and does not define how Elasticsearch stores fields.

5. A team keeps growing time-series log data and wants one stable write/search name with automatic rollover and tiered retention. Which TWO Elasticsearch features work together to deliver this? (Choose TWO)

   • A. A data stream that abstracts many backing indices behind one stable name
   • B. An index lifecycle management (ILM) policy that rolls over by age/size/doc count and manages hot/warm/cold/delete phases
   • C. A single giant static index that is never rolled over
   • D. A Kibana saved search pinned to one fixed index
   • E. A snapshot repository scheduled to overwrite the index hourly
   Show answer

   Correct: A and B. A data stream gives one stable write/search name (e.g. logs-*) over many backing indices, while an ILM policy automates rollover (age/size/doc count) and hot/warm/cold/delete phases. A static index, a Kibana saved search, and snapshots are not time-series rollover mechanisms — snapshots are for backup.

Last updated: 2026-10-19

ELASTIC-ANALYST practice test FAQ