Certification guide
Cybersecurity Defense AnalystSplunk Certified Cybersecurity Defense Analyst: the honest guide
Everything Splunk publishes about Cybersecurity Defense Analyst, in one place: what the exam asks, how the domains are weighted, and what it takes to be ready.
This guide page is built from the registry, not written yet.
Everything below comes from Cybersecurity Defense Analyst’s published exam data, and every figure links to the vendor page it came from. The researched version, with study plans and the parts nobody publishes, is still being written. This page is not submitted to search engines until it is.
Practise Cybersecurity Defense Analyst questions in the meantimeWhat the exam actually asks you to do
66 multiple choice questions and nothing else. Splunk sets no lab and no simulation on this exam, so the practice that matters is reading a scenario and choosing well under the clock.
Item formats
- Multiple choice
Nothing here needs a lab. Reading carefully and eliminating options is the whole skill. Splunk, Splunk Certified Cybersecurity Defense Analyst certification track ↗
Domain breakdown and official weightings
From the official Splunk certification tracks. Threat and Attack Types, Motivations, and Tactics is the heaviest domain at 20 percent, followed by Defenses, Data Sources, and SIEM Best Practices at 20 percent.
- The Cyber Landscape, Frameworks, and Standards10%
- Threat and Attack Types, Motivations, and Tactics20%
- Defenses, Data Sources, and SIEM Best Practices20%
- Investigation, Event Handling, Correlation, and Risk20%
- SPL and Efficient Searching20%
- Threat Hunting and Remediation10%
Where to focus: Four sections carry 20% each: attack types, defences and SIEM practice, investigation and risk, and SPL. That is 80% of the paper, and only one of the four is about writing searches.
What comes after passing
Cybersecurity Defense Analyst is valid for 3 years. All Splunk certifications run a three year life cycle from the date of the highest certification exam passed. Splunk stopped renewing certifications through coursework on 1 March 2026, so renewal now means either retaking the same exam in the final year of the window or earning a higher level certification in the same track. Splunk says a certification you let lapse is marked inactive, and that you then restart the programme at the Splunk Core Certified Power User level.
Where people go next
Costs across the full renewal cycle are on the Cybersecurity Defense Analyst cost page.
Frequently asked questions
How much does the Splunk Certified Cybersecurity Defense Analyst exam cost?
Splunk lists the exam at $130 USD per exam attempt and delivers it through its testing partner Pearson VUE, at a test centre or with an online proctor. A retake costs the same $130 again.
How long is the exam and how many questions does it have?
Splunk publishes 66 multiple choice questions in 75 minutes. Splunk notes on the test blueprint that the 75 minutes include three minutes to review the exam agreement, so the working time is 72.
What is the passing score?
Splunk publishes no passing score for this exam, and no exam code either. It states the question count, the time limit and the section weightings on its test blueprint and stops there, so any percentage you see quoted elsewhere is somebody's estimate rather than Splunk's number.
What do I need before I can sit it?
Splunk lists no prerequisite for this exam. Anyone can register for it.
Keep reading
Cybersecurity Defense Analyst practice questions
Free sample questions with the full explanation on every answer.
Free Cybersecurity Defense Analyst practice test
Ten real questions, playable now. No account, no card.
Cybersecurity Defense Analyst exam objectives
The full official blueprint, with practice pages on covered objectives.
Cybersecurity Defense Analyst passing score
The exact cut score, what kind of number it is, and the retake terms.
How hard is Cybersecurity Defense Analyst?
An honest difficulty read from the format, the clock and the weights.
Practise Cybersecurity Defense Analyst for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free Cybersecurity Defense Analyst questions