Free Splunk Certified Cybersecurity Defense Engineer Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Splunk Certified Cybersecurity Defense Engineer Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An engineer compares event timestamps with indexing timestamps to investigate ingestion delay. Which calculation measures this delay for each event?

   1. A.Indexing timestamp minus event timestampCorrect answer: A
   2. B.Event timestamp minus indexing timestamp
   3. C.Current timestamp minus indexing timestamp
   4. D.Current timestamp minus event timestamp

   Explanation: The diagnostic example calculates "delay_sec=_indextime-_time". This subtracts event time from indexing time; the other expressions reverse the difference or compare a timestamp with the present.

   Reference: Event indexing delay — Diagnosis

2. 2A detection engineer raises the alert threshold for a mail-spoofing score. According to the detection design, which tradeoff should the engineer expect?

   1. A.Fewer false positives, but more subtle spoofing may be missedCorrect answer: A
   2. B.More false positives, but more subtle spoofing may be missed
   3. C.Fewer false positives, while more subtle spoofing is detected
   4. D.More false positives, while more subtle spoofing is detected

   Explanation: The detection strategy states, "Defines sensitivity to SPF/DKIM/DMARC failures; higher thresholds reduce false positives but may miss stealthier spoofing." Raising the threshold reduces noisy matches at the cost of potentially missing stealthier activity.

   Reference: Detection Strategy for Email Spoofing — Analytic AN1202, SpoofScoreThreshold

3. 3Before consuming a shared threat indicator feed, an analyst checks a digital signature to verify the content's integrity and origin. Which activity is the analyst performing?

   1. A.Indicator validationCorrect answer: A
   2. B.Indicator extraction
   3. C.Indicator categorization
   4. D.Indicator prioritization

   Explanation: The guidance defines "Validation: verifying the integrity of indicator content and provenance through digital signatures, cryptographic hashes, or other means." The signature check addresses integrity and provenance.

   Reference: Guide to Cyber Threat Information Sharing — Section 4.3, Consume and Use Indicators

4. 4A response workflow sends one analyst a required question at 10:00. The analyst opens it at 10:03 and submits a decision at 10:05; the case is updated at 10:07 and reviewed at 10:09. What is the earliest time the workflow can resume after receiving the required answer?

   1. A.10:00
   2. B.10:03
   3. C.10:05Correct answer: C
   4. D.10:07

   Explanation: The workflow guide states, "Select the Required checkbox if the approver must answer the question in order for the playbook to resume running." The decision arrives at 10:05, after the prompt is opened.

   Reference: Require user input using the Prompt block in your Splunk SOAR playbook — Prompt users or groups who are logged into Splunk SOAR (Internal prompts)

5. 5Two incidents were discovered 30 and 90 minutes after their estimated occurrence times. What is the mean time to detection for these two incidents?

   1. A.30 minutes
   2. B.60 minutesCorrect answer: B
   3. C.90 minutes
   4. D.120 minutes

   Explanation: The metric is defined as "Information security metric calculated by subtracting the estimated date/time of incident occurrence from the date/time of incident discovery, averaged across the number of total incidents detected". The two delays average (30 + 90) / 2 = 60 minutes.

   Reference: Metrics for Measuring the Efficacy of Cyber Information Sharing — Glossary, Mean time to incident detection

6. 6An analyst finds several separate log records merged into one searchable event. Which data quality issue should the analyst investigate?

   1. A.Event time zone detection
   2. B.Event line breakingCorrect answer: B
   3. C.Event timestamp parsing
   4. D.Event field aggregation

   Explanation: The documentation says, "Line breaks: When there are problems with line breaks, the ability to parse your data into the correct separate events that it uses for searching is affected." Merged records indicate an event-boundary problem.

   Reference: Verify data quality — Generally, data quality issues

7. 7An engineer wants to detect possible credential guessing that eventually grants an attacker access. Which authentication sequence should the analytic correlate?

   1. A.Repeated failed logons followed by a successful logonCorrect answer: A
   2. B.Repeated failed logons followed by an account lockout
   3. C.Repeated successful logons followed by a failed logon
   4. D.Repeated successful logons followed by an account lockout

   Explanation: The analytic describes a "High volume of failed logon attempts followed by a successful one from a suspicious user, host, or timeframe". The success is the later outcome used by this particular analytic.

   Reference: Brute Force Authentication Failures with Multi-Platform Log Correlation — Analytic AN1275

8. 8A threat intelligence team evaluates whether a feed addresses threats likely to affect its own operating environment. Which indicator quality is the team assessing?

   1. A.Indicator timeliness
   2. B.Indicator relevanceCorrect answer: B
   3. C.Indicator accuracy
   4. D.Indicator specificity

   Explanation: The guidance states, "Relevant. Indicators should be applicable to a recipient’s operating environment and address threats the organization is likely to face." Relevance concerns the fit to the recipient's environment and likely threats.

   Reference: Guide to Cyber Threat Information Sharing — Section 4.3, indicator characteristics

9. 9A security integration must retrieve the current representation of an identified resource through an HTTP API. Which request method has that intended meaning?

   1. A.GETCorrect answer: A
   2. B.POST
   3. C.PUT
   4. D.DELETE

   Explanation: HTTP semantics state, "The GET method requests transfer of a current selected representation for the target resource." GET requests the selected representation of the target resource.

   Reference: RFC 9110: HTTP Semantics — Section 9.3.1, GET

10. 10A security manager needs a report to run every week and deliver its results to designated stakeholders. Which report configuration supports this recurring delivery?

    1. A.Schedule the reportCorrect answer: A
    2. B.Accelerate the report
    3. C.Clone the report
    4. D.Embed the report

    Explanation: The reporting guide states, "Schedule the report so that it runs on a regular interval. Scheduled reports can perform actions each time they run, such as sending report results via email to a set of stakeholders." Scheduling supports both the interval and the delivery action.

    Reference: Create and edit reports — Create and edit reports, report actions