OpenExamsFREE PRACTICE — ANY EXAM

Splunk Certified Cybersecurity Defense Engineer — Requirements & Free Practice

US · License preparation

100 free questions · Answer explanations · No signup required

Loading selected examination banks…

Choose what to practice

Start with an exam below. Your examination requirements depend on your application pathway. View licensing requirements

Licenses, application pathways and examination requirements

Each license and applicant pathway has its own requirements and exemptions. Choosing practice questions does not determine your eligibility.

Splunk Certified Cybersecurity Defense Engineer

Certification validating SOC engineering skills with Splunk Enterprise Security and Splunk SOAR, including detections, workflows and automations.

Licensing authority: Cisco Systems, Inc. · Application information

Initial by examination
Splunk Certified Cybersecurity Defense Engineer Exam
Age
At least 18; candidates 13-17 need parental acknowledgement/permission. Under 13 are not eligible under the program agreement, subject to its expressly applicable local-law provision.
Appointment Migration
Existing appointments through the former Splunk system are honored through March 1, 2027; this does not establish a retirement date for the examination.
Award Requirement
Pass the named examination and comply with the certification program and examination agreements.
Dates
No official start or examination-version end date was published in the current applicable materials; checkedAt is the actual research date, not an effective date.
Delivery
In-person Pearson test-center or online proctoring are delivery options for the same examination; appointments depend on actual availability. Online candidates must meet Pearson system requirements and pass the system test on the same computer and location; online registration also requires agreement to the Pearson facial comparison policy, with call-center registration described for nonacceptance.
Evidence Claim Ids
["nde-route-20261027","nde-registration-20261027","nde-assessment-20261027"]
Exam Conditions
Closed book; agree to the certification agreement within the initial three-minute timer. No separate mandatory school, lab, performance or writing examination is prescribed in the selected track.
Payment And Identification
Pay the applicable exam fee; provide valid photo ID and a second identification showing legal name; accept the Splunk/Cisco certification agreement and Pearson Candidate Rules Agreement.
Prerequisite Certifications
None.
Prerequisite Courses
None.
Prerequisite Exams
None.
Recommended Preparation
Power User-level knowledge of Splunk Enterprise and familiarity with Administrator tasks in Splunk Cloud or Splunk Enterprise; the training list is suggested and non-exhaustive, not required coursework.
Registration
Current valid email, Splunk.com account as stated by the candidate handbook, and Cisco certification-tracking account; registration name must match photo ID. The migration FAQ states that a separate Splunk ID is no longer needed. New registrations after October 20, 2026 use Cisco.

Splunk Certified Cybersecurity Defense Engineer Exam

Provider
Pearson VUE
Format
Multiple choice; closed book; in-person test-center or online proctored delivery.
Exam questions
Total questions: 60.
Time limit
75 minutes, including 3 minutes to review the exam agreement.
Exam fee
$130 USD per exam attempt.
Examination outline
  • Data Engineering (10%)
    • Perform effective data review and analysis.
    • Create and maintain performant data indexing.
    • Understand and apply Splunk methods of data normalization.
  • Detection Engineering (40%)
    • Create and tune detections (i.e. Correlation Search).
    • Incorporate context into detections (i.e. Correlation Search).
    • Understand and create risk-based modifiers and detections.
    • Generate effective Notable Events/findings.
    • Create and maintain a detection lifecycle.
  • Building Effective Security Processes and Programs (20%)
    • Research, incorporate and develop threat intelligence.
    • Use common methodologies for risk and detection prioritization.
    • Generate documentation and standard operating procedures.
  • Automation and Efficiency (20%)
    • Develop automation and orchestration for standard operating procedures.
    • Optimize Case Management.
    • Describe and utilize REST APIs.
    • Automate responses using SOAR playbooks.
    • Compare and validate integrations and automation capabilities of Enterprise Security and SOAR.
  • Auditing and Reporting on Security Programs (10%)
    • Develop and optimize security metrics.
    • Build and populate effective security reports.
    • Build and populate dashboards for program analytics.
Examination sources