Free Splunk Certified Cybersecurity Defense Analyst Sample Questions

Correct answer: A — A tactic represents an adversary's objective, while a technique is a specific method used to achieve that objective

• A. Correct. In MITRE ATT&CK, tactics represent the adversary's overall goal at a given stage, such as persistence or exfiltration, while techniques describe the specific method used to accomplish that goal.
• B. Incorrect. This reverses the relationship; techniques are the specific methods, and tactics are the higher-level objectives those methods support, not the other way around.
• C. Incorrect. Both tactics and techniques are industry-standard MITRE ATT&CK terminology; neither is a Splunk-specific label.
• D. Incorrect. Tactics and techniques in MITRE ATT&CK apply broadly across attack surfaces including network, endpoint, and cloud, and are not restricted by vector in this way.

Correct answer: A — Tiering routes alerts by complexity so junior staff triage volume while senior staff focus on deep investigation.

• A. Organizing analysts by tier lets less experienced staff handle high-volume initial triage while more experienced staff focus their time on complex investigation and threat hunting. This division makes efficient use of differing skill levels across the team.
• B. Vacation scheduling is an administrative matter unrelated to why a tiered skill and responsibility structure exists. The tier system is built around expertise and alert complexity, not time-off management.
• C. The entire point of tiering is to avoid redundant effort by routing alerts to the appropriate skill level rather than having every analyst repeat identical steps. Duplicating work across tiers would undermine the efficiency the structure is meant to provide.
• D. Escalation between tiers is a core mechanism of the tiered model, not something it eliminates. Alerts that exceed a lower tier's scope are expected to move upward through defined escalation paths.

Correct answer: A — Multiply the likelihood rating by the impact rating to produce a composite risk score

• Multiply the likelihood rating by the impact rating to produce a composite risk score. This reflects the standard risk formula, risk equals likelihood times impact, which captures both how probable an event is and how severe its consequences would be. Combining both factors this way is why the analyst's scenario mentions both a high probability and significant potential damage.
• Add the likelihood rating to the impact rating and divide by two for an average score. Averaging the two ratings understates risk when one factor is extreme, since a very high likelihood paired with a moderate impact could average out to a misleadingly low score. This is not the conventional risk-scoring approach used in basic risk management.
• Use only the impact rating, since likelihood is subjective and hard to quantify. Ignoring likelihood entirely would treat a rare but catastrophic event the same as a near-certain one, which misrepresents actual exposure. Standard risk assessment explicitly incorporates likelihood alongside impact rather than discarding it.
• Use only the likelihood rating, since impact is realized only after an incident occurs. Ignoring impact would treat a highly likely but low-consequence event the same as one that could cause severe damage, which fails to prioritize risks correctly. Impact is estimated in advance as part of the assessment, not only after the fact.

Correct answer: A — Risk register

• Risk register. A risk register is specifically designed to catalog identified risks along with their owners, likelihood and impact ratings, and remediation status. That matches every element the CISO described.
• Business continuity plan. A business continuity plan documents how the organization will keep critical functions running during a disruption, not a running catalog of individual risks and their scoring. The described artifact tracks risk details rather than continuity procedures.
• Incident response plan. An incident response plan outlines the steps and roles for handling a security incident once it occurs, rather than tracking pre-incident risk identification and scoring. The document described is used before an incident, for ongoing risk management.
• Data classification policy. A data classification policy defines categories of data sensitivity and associated handling rules, not a list of individual risks with owners and scores. It serves a different governance purpose than the artifact the CISO is requesting.

Correct answer: A — Command and control (C2) server

• A. This is correct because a server that malware contacts to receive instructions and exfiltrate data is functioning as command and control infrastructure, which enables an attacker to direct a compromise remotely.
• B. This is incorrect because a threat intelligence feed source supplies indicators for defenders to consume, it does not issue instructions to malware or receive stolen data from infected hosts.
• C. This is incorrect because a zero trust policy engine evaluates access requests against defined policies, it is not an attacker-operated server used to control malware.
• D. This is incorrect because an email gateway filters and routes mail traffic, it does not serve as a remote instruction channel for malware running on an endpoint.

Correct answer: B — Business email compromise

• A. There is no indication of malicious software being delivered or executed in this scenario. The attack relies purely on social manipulation through a fraudulent message, not a payload.
• B. This matches a business email compromise: an attacker impersonates an executive using a spoofed or look-alike domain to pressure an employee into an unauthorized financial transaction. The urgency, confidentiality claim, and near-identical sender domain are hallmark indicators.
• C. Credential stuffing involves using previously stolen username and password pairs to log into accounts automatically. This scenario does not involve any login attempts or reused credentials.
• D. A watering hole attack compromises a trusted website to infect its regular visitors, which has no relation to a targeted fraudulent email requesting a wire transfer.

Correct answer: A — Drive-by download

• A. Malware installing automatically simply because a page loaded, delivered through a compromised advertisement on an otherwise legitimate site, is the hallmark of a drive-by download, which requires no click or explicit user action.
• B. Credential stuffing involves automated login attempts with previously stolen credentials, which has no relationship to malware silently installing from a compromised advertisement.
• C. SQL injection targets a web application's database layer through crafted input; it does not describe malware being pushed to a visitor's machine through an ad network.
• D. Phishing requires the victim to be deceived into taking an action, such as clicking a link, whereas this attack installs malware passively as soon as the page renders.

Correct answer: A — To provide additional framework context that helps analysts manage and prioritize investigations

• A. This is correct because annotations enrich a detection's results with mapped framework context, such as technique IDs or control references, so analysts can better understand and prioritize what they are investigating.
• B. Annotations do not trigger remediation actions; they only attach descriptive context to a detection's output, so automatic remediation is not something they perform.
• C. Annotations are plain metadata fields stored alongside a detection and are not an encryption mechanism for risk index data.
• D. A correlation search still needs its own search logic to generate results; annotations only add descriptive labels to those results and cannot substitute for the search itself.

Correct answer: A — File hashes, IP addresses, and domains used as indicators for detection

• A. Tactical intelligence is defined by concrete, technical indicators like hashes, IPs, and domains that analysts feed directly into detection tooling.
• B. Long-term geopolitical trends that shape multi-year budget decisions describe strategic intelligence, which is broader and less immediately actionable than tactical detail.
• C. Motivations and capabilities of threat actor groups are the focus of operational intelligence, not the specific indicators that define the tactical tier.
• D. Financial projections about breach costs fall outside the standard threat intelligence tiers and are not what tactical intelligence focuses on.

Correct answer: A — The team lacks detections tied to techniques under the Exfiltration tactic and should prioritize building them

• A. This is correct because a heat map showing no coverage for a tactic indicates a real gap in the team's detection portfolio, which is exactly the actionable insight this exercise is meant to surface. Prioritizing new correlation searches for techniques under that tactic directly addresses the gap.
• B. Correlation searches are a standard and effective way to detect data staging and transfer behaviors associated with Exfiltration, so this tactic is not inherently undetectable through that method. The absence of coverage reflects a gap to fill, not a tooling limitation.
• C. There is no requirement to achieve full coverage everywhere else before addressing one gap; teams typically prioritize gaps based on risk and threat relevance rather than working through tactics in strict sequence. This option imposes an unnecessary ordering constraint.
• D. Exfiltration is documented as a tactic within the MITRE ATT&CK matrix, which is precisely why it appears as a category on a tactic-based heat map in the first place. Reclassifying it as a procedure contradicts how the framework organizes its categories.

Correct answer: A — Email gateway logs

• A. Email gateway logs record message-level metadata including sender, recipient, subject, and attachment details, which is exactly the information needed to confirm a phishing delivery.
• B. DNS query logs show which domains were resolved by a host, which can support later investigation of a malicious link but do not contain email header or attachment metadata.
• C. Firewall session logs record network connections by IP, port, and protocol, and do not capture application-layer email content such as sender or subject.
• D. EDR process logs show what happened on the endpoint after a file was opened, such as a spawned process, but they do not contain the original email's sender or subject metadata.

Correct answer: A — Identity provider or domain controller authentication logs

• A. Identity provider or domain controller authentication logs record logon attempts, successes, failures, and source, which is exactly the data needed to detect a brute-force or password-spray pattern.
• B. Wireless signal-strength logs describe radio conditions for access points and have no record of user authentication attempts.
• C. Backup job completion logs track whether scheduled backups succeeded and contain no user logon information.
• D. Software license usage reports track application entitlement consumption and do not capture authentication events.

Correct answer: A — Enable asset and identity correlation selectively for that one sourcetype rather than turning it on universally

• A. Enterprise Security supports enabling asset and identity correlation on a per-sourcetype basis, so an admin can turn it on just for the proxy sourcetype without applying it universally across every other data source.
• B. Selective, sourcetype-scoped enablement is a supported configuration option, so universal enablement is not the only available choice when narrower scoping is what is required.
• C. Disabling the feature entirely would remove the correlation for the proxy logs as well, which does not satisfy the requirement to enable it specifically for that sourcetype.
• D. Deleting unrelated sourcetypes is a drastic and unnecessary data-loss action; scoping correlation to one sourcetype is achieved through configuration, not by removing other data from the index.

Correct answer: A — Common Information Model add-on

• A. The Common Information Model add-on packages the shared data models, tags, and documentation used to normalize field names and event tags across vendors, and it ships as part of Enterprise Security.
• B. The Universal Forwarder is a lightweight agent that collects and forwards data to indexers; it has no role in defining shared field names or event tags across vendors.
• C. The Deployment Server distributes configuration bundles to forwarders and other Splunk components; it is a management tool, not the source of cross-vendor field normalization.

Correct answer: A — Enter the technique identifier into the ATT&CK Technique filter to list matching content

• A. The content page lets an analyst search or paste technique identifiers directly into this filter, which returns exactly the detections mapped to that technique.
• B. The Journey dashboard tracks maturity progression through the program, not per-technique detection mappings, so manually scanning it would not reliably surface the right content.
• C. Filtering by originating app only separates native content from third-party contributed content and has no relationship to a specific attack technique.
• D. Alphabetical sorting by title is not designed to reveal technique mappings and would be an unreliable, manual way to find the right detections.

Correct answer: A — Security Content page filtered by data

• A. The content catalog, filtered by the Data Sources option, is purpose-built to surface pre-built detections tied to a specific sourcetype, making it the correct place to look.
• B. The license usage report tracks ingestion volume against licensing entitlements and has no role in surfacing detection content for a sourcetype.
• C. Index cluster replication status concerns indexer clustering health and data redundancy, not the discovery of detection content for a data source.

Correct answer: A — MTTA is strong, but MTTR indicates that remediation steps after triage are taking longer than desired

• A. A short acknowledgment time paired with a long overall resolution time points to a bottleneck in the investigation or containment steps that happen after an analyst first picks up the notable.
• B. A 3-minute average acknowledgment time is fast, not poor, so this option mischaracterizes what the acknowledgment metric is showing.
• C. The remediation time grew to 6 hours, which is the opposite of resolving incidents faster, so this option contradicts the data given.
• D. Dwell time measures attacker presence before detection and is unrelated to how quickly an analyst acknowledges a notable after it has already fired.

Correct answer: A — Mean Time to Acknowledge (MTTA)

• A. Mean Time to Acknowledge measures the gap between a notable being generated and an analyst first engaging with it, which matches the 7-minute interval described.
• B. Mean Time to Detect covers the period before the notable existed at all, from initial compromise to the notable firing, not the time after it appeared.
• C. Mean Time to Repair measures the full response through containment and remediation, which has not started yet at the point the analyst merely picks up the case.
• D. Dwell time reflects how long a threat was present before any notable was generated, so it ends before this acknowledgment interval even begins.

Correct answer: A — The ongoing, near-real-time collection and analysis of security data to identify threats as they occur.

• A. This describes continuous monitoring accurately: security data is collected and analyzed as it arrives so threats can be identified without waiting for a scheduled review.
• B. A weekly manual log review is a periodic, point-in-time check rather than an ongoing process, so it does not provide the near-real-time visibility continuous monitoring requires.
• C. A quarterly compliance audit checks controls at a single moment in time and is not designed to surface security incidents as they happen.
• D. Archiving data for retention purposes addresses legal recordkeeping needs but does not involve the active analysis needed to detect threats.

Correct answer: A — Benign Positive - Suspicious But Expected, because the export activity is legitimate and consistent with the approved maintenance window

• A. The bulk export was performed by an authorized administrator during a planned maintenance window, matching exactly what this classification is meant to capture. The activity looks suspicious in pattern but is expected and legitimate.
• B. This would apply if the export were carried out by an unauthorized or attacker-controlled account, but the scenario confirms the administrator's authorized task. There is no indication of malicious intent.
• C. This classification fits when the search's detection logic itself is fundamentally broken, but nothing in the scenario suggests the rule is flawed. The search correctly identified export activity that simply turned out to be expected.
• D. This applies when missing or corrupted fields cause a false trigger, but the scenario gives no indication of a data quality problem. The account and activity were both correctly identified.

Correct answer: A — False Positive - Incorrect Analytic Logic, because the search's detection logic fails to exclude known scheduled expiration behavior

• A. The search's own logic never accounts for the scheduled expiration job, meaning the detection rule itself is the root cause of the recurring false alerts. This is a flaw in the analytic logic rather than a data problem.
• B. This classification applies when missing or corrupted fields cause a mismatch, but the scenario describes a rule that never accounted for expiration behavior in the first place. The data itself is accurate; the logic is not.
• C. This disposition is reserved for activity that is genuinely legitimate and expected, but a recurring false trigger caused by flawed detection logic is not the same as expected suspicious-looking activity. The root cause here is the search design.
• D. Repeated failed logins do not always indicate an active attack, and in this scenario they stem from a routine expiration job rather than credential abuse. Treating this as a confirmed attack would misclassify a known benign process.

Correct answer: A — Contributing events

• A. Correct. Contributing events are the individual risk events that a risk incident rule rolls together into the resulting risk notable, and they remain listed under it for drill-down.
• B. Incorrect. Risk modifiers are the adjustable factors that influence how a risk score is calculated for an event, not the rolled-up events themselves.
• C. Incorrect. Adaptive response actions are automated steps attached to a correlation search, unrelated to the list of underlying events shown under a risk notable.
• D. Incorrect. Correlation searches are the saved detection logic that produced the entries; the entries themselves, not the searches, are what appear in the drill-down list.

Correct answer: A — The action cannot associate the score with any entity, so no properly attributed risk event is written to the risk index

• A. Correct. Risk Analysis requires a risk object mapping to know which entity a score belongs to, so without it the action cannot write a properly attributed risk event.
• B. Incorrect. The action does not fall back to whichever entity scored highest previously; without a mapped risk object it cannot determine which entity to attribute the score to at all.
• C. Incorrect. Splunk Enterprise Security does not substitute the correlation search's own name as a stand-in risk object; the risk object field must be explicitly mapped.
• D. Incorrect. A missing risk object mapping affects only the Risk Analysis action's output; it does not halt the correlation search's own schedule.

Correct answer: A — Risk Analysis

• A. This dashboard is built to show accumulated risk scores per risk object, along with the contributing risk events that raised the score over time.
• B. This dashboard summarizes overall notable event volume and urgency rather than tracking a single object's accumulating risk score.
• C. This dashboard covers internal ES process health and background job status, not a user's risk score history.
• D. This dashboard is oriented toward packet-capture network insights and does not present risk score accumulation for a user.

Correct answer: A — Audit dashboards

• A. This dashboard category covers internal ES operational health, including background processes and data model status, matching the administrator's need.
• B. This dashboard summarizes notable event volume and urgency, not the internal health of ES background processes.
• C. This dashboard tracks accumulated risk scores for risk objects, not the operational health of ES processes.
• D. This dashboard lists notable events for triage rather than reporting on background process or data model health.

Correct answer: A — The combined risk score for that risk object has not yet crossed the threshold configured in the risk incident rule.

• A. This is correct. A risk incident rule only creates a notable once the aggregated score for a risk object exceeds its configured threshold, so ten low-scoring events may simply not have reached that point yet.
• B. This is incorrect. Role-based permissions control who can view data but do not cause a notable to exist invisibly; if the threshold were met, a notable would appear in Incident Review for authorized users.
• C. This is incorrect. Risk incident rules run on their own configured schedule and evaluate accumulated scores whenever they execute, not on a fixed once-per-day notable creation cycle.
• D. This is incorrect. The risk index stores risk events for both asset and identity risk objects, including users, so a user-tied risk object is fully capable of generating a risk notable.

Correct answer: B — Runs statistical calculations against indexed fields stored in tsidx files, including accelerated data model summaries.

• A. This describes `stats`, which scans raw events at search time. It is incorrect because it misses the key distinction that makes tsidx-based commands faster.
• B. This is correct: reading directly from tsidx files (raw index or accelerated data model summaries) instead of raw events is exactly what makes this command efficient for large-scale security aggregations.
• C. This describes generating fabricated test rows, which is unrelated to aggregating indexed field statistics.
• D. This describes grouping raw events into transactions, a different mechanism that operates on raw events rather than indexed tsidx data.

Correct answer: A — The SPL view toggle on the detection's detail panel

• A. Enabling the SPL view on a detection's detail panel reveals the underlying search logic along with prerequisite field and data checks, which is exactly what the analyst needs before enabling it.
• B. Manage Bookmarks only tracks detections the analyst has saved for later and does not expose the underlying search syntax.
• C. Journey Stage narrows the catalog by security maturity level and has no effect on revealing a detection's SPL.
• D. This filter groups content by the type of entity a risk score applies to and does not surface the search logic itself.

Correct answer: A — Deploy the detection into Enterprise Security through the ESCU integration

• A. Deploying through the ESCU integration is the documented path for turning a validated Security Essentials detection into a scheduled correlation search that produces notables in Enterprise Security.
• B. Bookmarking only saves the item for personal reference and does not push it into Enterprise Security as a running correlation search.
• C. Filtering by content status changes what is displayed in the catalog but performs no deployment action.
• D. Adjusting the Journey Stage filter changes which content is shown based on maturity level and does not deploy anything.
• E. Exporting raw metadata produces a file for reference but does not register the search as a running correlation search in Enterprise Security.

Correct answer: A — `index=wineventlog EventCode=4625 | fields _time, user, host`, filtering on the indexed EventCode value directly in the base search and dropping unneeded fields as early as possible.

• A. Correct — filtering on EventCode as an indexed base-search term avoids the unnecessary eval that recreates the same value, and adding fields right after narrows the data early, combining the two core best practices of filtering first and limiting fields early.
• B. Incorrect — this still performs the same unnecessary eval before filtering, and using where instead of search does not remove the wasted work of recomputing a field that already exists in the event.
• C. Incorrect — table does not reduce the underlying events scanned before the search filter runs, and the EventCode filter is still applied after every raw event has already been read into the table.
• D. Incorrect — aggregating with stats by EventCode before filtering throws away the individual _time, user, and host values the analyst actually needs, and still requires scanning and grouping every event before filtering.

Correct answer: A — Configure a scheduled summary-indexing search that pre-computes and stores the daily category totals as they occur, so the weekly report reads the small summary index instead of re-scanning a year of raw proxy logs.

• A. Correct — a summary-indexing search computes and stores the daily aggregates as new data arrives, so the recurring weekly report only has to read a small pre-aggregated summary index instead of rescanning a full year of raw proxy logs each time.
• B. Incorrect — running multiple copies of the same expensive raw scan in parallel increases total resource usage without reducing how much raw data any single run has to process.
• C. Incorrect — switching to a relative time token changes how the range is expressed but not how much underlying raw data is scanned each time the report runs.
• D. Incorrect — moving where the search executes does not reduce the amount of raw data that has to be read and aggregated; the year-long scan is still the same amount of work regardless of which search head runs it.

Correct answers: A, B, C — Indicator-based hunting; Configuration-based hunting; Behavioral analytics hunting

• A. Matching endpoint logs against a list of known-malicious hashes is a direct example of indicator-based hunting, since the search targets specific known-bad artifact values.
• B. Checking cloud storage settings for public exposure evaluates configuration state against a known-good baseline, which is configuration-based hunting.
• C. Profiling insider data-access sequences against peer-group norms to find deviation is behavioral analytics hunting, since it analyzes patterns of conduct rather than a single indicator or setting.
• D. Passive DNS enrichment is a data-source technique used to add context to domains during investigation, not one of the four hunting technique categories described in this scenario, and it is not one of the activities the analyst performed.
• E. Vulnerability scanning identifies exploitable weaknesses in software rather than searching for evidence of compromise, and it is not one of the activities the analyst performed in this hunt.

Correct answer: B — The rare, infrequent events that appear at the low-frequency end of the distribution

• A. This describes the head of the distribution, the common, high-volume activity, which is the opposite of what long tail analysis targets.
• B. The long tail is the rare, infrequent activity at the low-frequency end of the distribution, and hunting there surfaces unusual behavior that blends in with normal volume.
• C. Transaction duration is a metric produced by grouping related events, not a description of where an event sits in a frequency distribution.
• D. Signature-based flagging matches known-bad patterns directly and is unrelated to how frequently an event occurs in the dataset.

Correct answer: A — Restrict the action's permissions by role in the alert actions manager

• A. Adaptive response action permissions are managed per role through the alert actions manager, so restricting the Run Playbook in SOAR action there is the correct way to grant it to tier-2 analysts while hiding it from tier-1 analysts.
• B. Disabling the action for every role would remove it for tier-2 analysts as well, which fails the requirement that senior analysts retain the ability to run it.
• C. Removing the SOAR connector would break the integration entirely for all analysts and all notables, rather than selectively restricting who can invoke the action.
• D. Tying the action to a search macro controls which notables the action can apply to based on risk, not which analyst roles are permitted to see or run the action.

Correct answer: A — It sets the run_automation parameter to false for all but the last artifact, so the playbook fires once after all five are added.

• A. This matches the documented behavior: the integration disables automation on every artifact except the last one in the batch, so the playbook only starts once, after the complete set has been added.
• B. SOAR still receives five distinct artifacts; they are not merged into a single CEF value, since each artifact preserves its own mapped fields and event_id.
• C. There is no post-execution deduplication step; the integration prevents redundant runs upfront by controlling the run_automation flag rather than cleaning up after multiple runs.
• D. The correlation search does not pause execution waiting on playbook completion; artifacts are sent and the run_automation flag is what controls when the playbook actually starts.