Free Splunk Certified Cybersecurity Defense Architect Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Splunk Certified Cybersecurity Defense Architect practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A defense architect is comparing threat intelligence feeds for an organization whose systems and likely threats differ from those covered by one feed. Which indicator quality should the architect assess to determine whether that feed fits the environment?

   1. A.Timeliness
   2. B.RelevanceCorrect answer: B
   3. C.Specificity
   4. D.Actionability

   Explanation: NIST states, "Indicators should be applicable to a recipient’s operating environment and address threats the organization is likely to face." This describes relevance. Timeliness concerns delivery latency, specificity concerns clear observable events, and actionability concerns sufficient response context.

   Reference: NIST SP 800-150: Guide to Cyber Threat Information Sharing — Section 4.3, p. 22, indicator characteristics

2. 2A branch's only link to every remote location is intermittently unavailable. A security architect must collect branch logs during outages and forward them to a central server after connectivity returns. Which relay placement supports that requirement?

   1. A.Deploy a caching relay in the branch.Correct answer: A
   2. B.Deploy a caching relay at the central site.
   3. C.Deploy a caching relay in a cloud region.
   4. D.Deploy a caching relay at another branch.

   Explanation: NIST says "having log caching servers on a reliable local network allows the log generators to transfer their logs to those servers, which can then transfer the logs to the second level of log servers when network connectivity permits." The local relay remains reachable during the stated outage.

   Reference: NIST SP 800-92: Guide to Computer Security Log Management — Section 3.1, p. 3-2, distributed log servers

3. 3A security incident requires a decision by a higher level of management, so the response team brings that management level into the response process. Which incident management action does this represent?

   1. A.Incident elevationCorrect answer: A
   2. B.Incident escalation
   3. C.Incident triage
   4. D.Incident categorization

   Explanation: NIST states that "elevation usually indicates involving a higher level of management in the response efforts." It distinguishes escalation as generally increasing resources or time frames.

   Reference: NIST SP 800-61 Revision 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — Section 3.2, Incident Response, RS.MA-04, p. 28

4. 4An orchestration project depends on an action that analysts can perform in a security console, but the integration API exposes only a subset of console actions. What limitation should the architect assess?

   1. A.API functional coverageCorrect answer: A
   2. B.API response serialization
   3. C.API request throughput
   4. D.API credential rotation

   Explanation: The guide identifies the issue that "the API only exposes a subset of the functionality that the analysts use in operations." Available throughput, serialization, and credential rotation are different integration concerns and do not establish that the action is exposed.

   Reference: Enabling Automation in Security Operations: Assessing Automation Potential of Products and Services — Functionality Considerations, Comprehensive, p. 3

5. 5A detection engineer wants to test changes to detection logic without interfering with the current version in a shared repository. Which version-control operation best supports this workflow?

   1. A.Create a separate branchCorrect answer: A
   2. B.Create a release tag
   3. C.Merge the existing branches
   4. D.Rebase the production branch

   Explanation: The exam owner's guidance advises, "Put new or improved detections on a separate branch so they can get tested without interference." Tags identify revisions, while merging and rebasing perform different repository operations.

   Reference: Improving Your Security Detection Development Processes — Detection-as-code principles, Version control system

6. 6A defense architect documents the cybersecurity outcomes the organization has selected and prioritized for its desired future posture. Which framework artifact is being developed?

   1. A.Target ProfileCorrect answer: A
   2. B.Current Profile
   3. C.Community Profile
   4. D.Framework Tier

   Explanation: NIST states that "A Target Profile specifies the desired outcomes that an organization has selected and prioritized" for risk management. A Current Profile describes current outcomes, a Community Profile serves shared interests, and a Tier describes governance and management rigor.

   Reference: The NIST Cybersecurity Framework 2.0 — Section 3.1, CSF Profiles, p. 6

7. 7A security manager wants a measure of the average time a problem exists before the team finds it. Which measure fits that objective?

   1. A.Mean time to detectCorrect answer: A
   2. B.Mean time to recovery
   3. C.Mean time between failures
   4. D.Mean time to repair

   Explanation: NIST defines mean time to detect as "the average amount of time that a problem exists before it is found." Recovery, time between failures, and repair describe different intervals.

   Reference: NIST SP 800-55 Volume 1: Measurement Guide for Information Security — Section 4.4, Evaluating Methods for Supporting Continuous Improvement, p. 23

8. 8After a destructive cyber incident, a defense team restores affected systems and business operations. Which category of capability is being exercised?

   1. A.RecoveryCorrect answer: A
   2. B.Detection
   3. C.Prevention
   4. D.Incident analysis

   Explanation: NIST describes the recover function as "Assets and operations affected by a cybersecurity incident are restored." Detection finds adverse events, while prevention and analysis have different objectives.

   Reference: The NIST Cybersecurity Framework 2.0 — Section 2, Introduction to the CSF Core, Recover, p. 4

9. 9A threat-sharing community allows anonymous contributions. Several reports repeat the same claim, but their original sources are concealed. Which corroboration check is directly impeded by this lack of attribution?

   1. A.Whether the reports originate from independent sourcesCorrect answer: A
   2. B.Whether the reports describe the same observed behavior
   3. C.Whether the reports arrive within an actionable interval
   4. D.Whether the reports use a common machine-readable format

   Explanation: NIST states that if original sources cannot be identified, organizations "may be unable to confirm that information has been received from multiple independent sources". The other checks concern content, timing, and format rather than source independence.

   Reference: NIST SP 800-150: Guide to Cyber Threat Information Sharing — p. 5, Limiting Attribution

10. 10An incident investigation finds that event timestamps are consistently shifted because the clocks on log sources drift apart. Which integration measure addresses the source of that problem?

    1. A.Synchronize the clocks of the log sources.Correct answer: A
    2. B.Normalize the formats of the log fields.
    3. C.Aggregate repeated entries from the log sources.
    4. D.Correlate matching entries across the log sources.

    Explanation: NIST recommends "time synchronization technologies such as Network Time Protocol (NTP) servers whenever possible to keep log sources’ clocks consistent with each other." Consistent formatting, aggregation, and correlation do not themselves correct clock drift.

    Reference: NIST SP 800-92: Guide to Computer Security Log Management — Section 3.2, p. 3-4, footnote 24