OpenExamsFREE PRACTICE — ANY EXAM

Free Splunk Certified Cybersecurity Defense Analyst Practice Questions

100 free questions · Answer explanations · No signup required

View examination details, outline and sources

Loading selected examination banks…

Sample Practice Questions

Try these 10 sample questions from the Splunk Certified Cybersecurity Defense Analyst practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

  1. 1A security operations center is defining its architecture and a roadmap for improving it across the organization. Which role is principally associated with this responsibility?

    1. A.Security architectCorrect answer: A
    2. B.Security tools engineer
    3. C.Threat researcher
    4. D.SOC analyst

    Explanation: The security architect role includes: "Define SOC architectures and safety-roadmaps for an organization." This responsibility matches the architectural roadmap described in the scenario.

    Reference: Configure and administer Splunk Enterprise Security — Persona roles and responsibilities, Security architect

  2. 2An employee receives a targeted email containing a spreadsheet file. Opening the spreadsheet executes an embedded payload. Which initial-access technique is illustrated?

    1. A.Spearphishing attachmentCorrect answer: A
    2. B.Spearphishing link
    3. C.Spearphishing via service
    4. D.Spearphishing voice

    Explanation: The source states, "Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems." The file is attached to the targeted email, rather than being a link or a voice communication.

    Reference: Phishing: Spearphishing Attachment — Technique description

  3. 3A security team wants a dedicated passive sensor to inspect packets crossing a network, recognize suspicious activity automatically and record relevant details. Which system is intended for that role?

    1. A.Network packet capture system
    2. B.Network intrusion detection systemCorrect answer: B
    3. C.Network intrusion prevention system
    4. D.Network vulnerability scanning system

    Explanation: NIST describes this system as "Software that performs packet sniffing and network traffic analysis to identify suspicious activity and record relevant information." The requested sensor analyzes network packets for suspicious activity.

    Reference: Network Intrusion Detection System - CSRC Glossary — Definition, NIST SP 800-86

  4. 4An operations manager wants the average interval from when a security problem begins until the team discovers it. Which metric measures this interval?

    1. A.Mean time to recovery
    2. B.Mean time to detectCorrect answer: B
    3. C.Mean time between failures
    4. D.Mean time to repair

    Explanation: NIST defines mean time to detect as "A metric that tracks the average amount of time that a problem exists before it is found." This is the interval the manager wants.

    Reference: Mean Time to Detect - CSRC Glossary — Definition, NIST SP 800-55 Volume 1

  5. 5At 09:28, an analyst needs the complete activity from a suspicious connection at 08:54 through an alert at 09:25. Which search interval covers both timestamps while retrieving the least unrelated history?

    1. A.08:50–09:30Correct answer: A
    2. B.09:00–09:30
    3. C.08:30–09:30
    4. D.08:00–09:30

    Explanation: The search guidance recommends identifying "the smallest window of time necessary for your search." The 08:50–09:30 interval contains both relevant timestamps and has the shortest duration among the qualifying options.

    Reference: Quick tips for optimization — Limit the data from disk, Narrow the time window

  6. 6A threat hunter collects known malicious IP addresses and file hashes, searches network and endpoint artifacts for matches, and investigates the results. Which hunting approach is being used?

    1. A.Frequency analysis
    2. B.Pattern analysis
    3. C.Indicator-of-compromise searchCorrect answer: C
    4. D.Anomaly detection

    Explanation: CISA describes an IOC search as collecting "known-bad indicators of compromise from a broad variety of sources" and searching for them in network and host artifacts. The hunter is matching known indicators and then checking the results.

    Reference: Technical Approaches to Uncovering Malicious Activity — Description, Indicators of Compromise Search, page 3

  7. 7A security team classifies its work to discover and analyze possible attacks using the NIST Cybersecurity Framework 2.0. Which function matches that work?

    1. A.Respond
    2. B.Protect
    3. C.DetectCorrect answer: C
    4. D.Recover

    Explanation: The framework states: "DETECT (DE) — Possible cybersecurity attacks and compromises are found and analyzed." Finding and analyzing the possible attack is therefore a Detect outcome.

    Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Section 2, CSF Core functions, page 4

  8. 8An analyst investigates a workstation compromised when its user browsed a website hosting attacker-controlled exploit code. Which attack technique most directly describes the initial access?

    1. A.Drive-by compromiseCorrect answer: A
    2. B.Supply chain compromise
    3. C.Exploit public-facing application
    4. D.External remote services

    Explanation: The source states, "Adversaries may gain access to a system through a user visiting a website over the normal course of browsing." The compromised system is the visitor’s workstation.

    Reference: Drive-by Compromise — Technique description

  9. 9A SIEM receives equivalent authentication events from several vendors using different field names. The team maps them to a common set of fields and event tags so investigations can use a consistent schema. Which practice is this?

    1. A.Data anonymization
    2. B.Data acceleration
    3. C.Data normalizationCorrect answer: C
    4. D.Data aggregation

    Explanation: The common information model supports "using the same field names and event tags for equivalent events from different sources or vendors." That is the normalization described in the scenario.

    Reference: Overview of the Splunk Common Information Model — Why the CIM exists

  10. 10A security team repeatedly assesses its security posture, vulnerabilities, and threats at a frequency sufficient to support risk decisions. What activity is the team performing?

    1. A.Continuous monitoringCorrect answer: A
    2. B.Incident containment
    3. C.Penetration testing
    4. D.Forensic acquisition

    Explanation: NIST defines information security continuous monitoring as "Maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions." Its note clarifies that the assessment frequency must be sufficient for risk-based decisions.

    Reference: Information Security Continuous Monitoring - CSRC Glossary — Definitions and note

Topics in this practice bank

These topics describe the available practice for Splunk Certified Cybersecurity Defense Analyst. Review the examination outline and its sources for scope and allocation details.

  • The Cyber Landscape, Frameworks, and Standards
    • SOC organization and Analyst, Engineer and Architect roles
    • Cyber controls, standards, frameworks and their incorporation in Splunk
    • Information assurance, confidentiality, integrity, availability and basic risk management
  • Threat and Attack Types, Motivations, and Tactics
    • Common attacks and attack vectors
    • Common attack, adversary and security terminology
    • Threat intelligence tiers and application to threat analysis
    • Purpose and scope of annotations in Splunk Enterprise Security
    • Tactics, techniques and procedures
  • Defenses, Data Sources, and SIEM Best Practices
    • Cyber defense systems, analysis tools and threat analysis data sources
    • SIEM best practices and Enterprise Security operation, CIM, data models, acceleration, assets and identities
    • Assessing data sources and finding sourcetype content with Security Essentials and Enterprise Security
  • Investigation, Event Handling, Correlation, and Risk
    • Continuous monitoring and Splunk's five investigation stages
    • Analyst performance metrics
    • Recognizing and assigning event dispositions
    • Enterprise Security terms and their uses
    • Built-in Enterprise Security dashboards and their information
    • Risk Based Alerting, the Risk framework and correlation searches
  • SPL and Efficient Searching
    • Common SPL terms and their security analysis uses
    • Best practices for efficient searches
    • SPL resources in Enterprise Security, Security Essentials and Splunk Lantern
  • Threat Hunting and Remediation
    • Threat hunting techniques
    • Long tail analysis, outlier detection and hypothesis hunting
    • Using and configuring adaptive response actions
    • SOAR playbooks and triggering from Enterprise Security

How to use these free practice questions

Choose an answer, check the explanation, and review your progress by chapter. Practice questions and explanations are free to access without signing up.

These are independent study questions, not actual examination items. For examination requirements and official information, view Splunk Certified Cybersecurity Defense Analyst details.