OpenExamsFREE PRACTICE — ANY EXAM

Splunk Certified Cybersecurity Defense Analyst — Requirements & Free Practice

US · License preparation

100 free questions · Answer explanations · No signup required

Loading selected examination banks…

Choose what to practice

Start with an exam below. Your examination requirements depend on your application pathway. View licensing requirements

Licenses, application pathways and examination requirements

Each license and applicant pathway has its own requirements and exemptions. Choosing practice questions does not determine your eligibility.

Splunk Certified Cybersecurity Defense Analyst

Intermediate certification in security defense using Splunk Enterprise and Enterprise Security.

Licensing authority: Splunk · Application information

Initial by examination
Splunk Certified Cybersecurity Defense Analyst
Candidate Eligibility
The handbook requires a Splunk.com account with current email, a Cisco Certmetrics account with name matching photo ID, age 18 or parental acknowledgement for ages 13-17, the registration fee, photo ID and a second ID showing legal name, and agreement to certification and Pearson candidate rules. The migration FAQ removes the need for a Splunk certification ID; this is distinct from the handbook's Splunk.com account wording.
Date Applicability
The current official track links the undated blueprint. No official exam-version start/end date is published in the reviewed materials. The handbook version label is not treated as an official effective date for this credential, route or examination.
Delivery
In-person Pearson Test Center or at home with online proctoring; the examination is closed book. Online candidates must pass a system test on the same computer and location and meet technical requirements. Agreement review and acceptance is required within the included three minutes. Facial comparison policy applies to online scheduling; candidates declining that online registration term are directed to the Pearson call center by Appendix C.
Prerequisites
No prerequisite examinations, certifications or courses. Power User Level Knowledge of Splunk Enterprise is recommended. Listed learning-path courses are suggested preparation, not required training or a laboratory examination.
Registration
From October 20, 2026 register through Cisco's certification tracking system. Existing appointments made through Splunk remain honored through March 1, 2027. The latter date is not the examination's retirement date.
Scheduling
Appointment and seat availability must be confirmed in the live scheduling process for the requested 2026-11-25 through 2027-02-28 horizon. No official mandatory school arrangement or separate lab is specified in this selected route. Voucher terms, applicable cancellation rules, accommodation approval and retake waiting periods still apply.
Scope
Initial award of the selected individual certification through its current English knowledge examination.

Splunk Certified Cybersecurity Defense Analyst

Provider
Pearson VUE
Format
Closed-book multiple choice examination, delivered at a Pearson Test Center or with online proctoring.
Exam questions
Total questions: 66.
Time limit
75 minutes total, including 3 minutes to review the examination agreement.
Exam fee
$130 USD per examination attempt.
Examination outline
  • The Cyber Landscape, Frameworks, and Standards (10%)
    • SOC organization and Analyst, Engineer and Architect roles
    • Cyber controls, standards, frameworks and their incorporation in Splunk
    • Information assurance, confidentiality, integrity, availability and basic risk management
  • Threat and Attack Types, Motivations, and Tactics (20%)
    • Common attacks and attack vectors
    • Common attack, adversary and security terminology
    • Threat intelligence tiers and application to threat analysis
    • Purpose and scope of annotations in Splunk Enterprise Security
    • Tactics, techniques and procedures
  • Defenses, Data Sources, and SIEM Best Practices (20%)
    • Cyber defense systems, analysis tools and threat analysis data sources
    • SIEM best practices and Enterprise Security operation, CIM, data models, acceleration, assets and identities
    • Assessing data sources and finding sourcetype content with Security Essentials and Enterprise Security
  • Investigation, Event Handling, Correlation, and Risk (20%)
    • Continuous monitoring and Splunk's five investigation stages
    • Analyst performance metrics
    • Recognizing and assigning event dispositions
    • Enterprise Security terms and their uses
    • Built-in Enterprise Security dashboards and their information
    • Risk Based Alerting, the Risk framework and correlation searches
  • SPL and Efficient Searching (20%)
    • Common SPL terms and their security analysis uses
    • Best practices for efficient searches
    • SPL resources in Enterprise Security, Security Essentials and Splunk Lantern
  • Threat Hunting and Remediation (10%)
    • Threat hunting techniques
    • Long tail analysis, outlier detection and hypothesis hunting
    • Using and configuring adaptive response actions
    • SOAR playbooks and triggering from Enterprise Security
Examination sources