Objective 1.1
Cybersecurity Defense AnalystSummarize the organization of a typical SOC and the tasks belonging to Analyst, Engineer and Architect roles
Objective 1.1 sits in The Cyber Landscape, Frameworks, and Standards, which carries 10% of the Cybersecurity Defense Analyst exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An administrator is assigning Enterprise Security access. How many roles does Splunk document that the app adds to the platform defaults?
Correct.
Checked against help.splunk.com, August 2026Concept
A small set of roles maps to the way a security team actually divides work: watching, working incidents, and running the platform. More roles would need more decisions than the split justifies.
Why A
Splunk documents that Enterprise Security adds three roles to the default roles provided by the Splunk platform.
Source
Splunk Docs: Configure users and roles for Splunk Enterprise Security, checked August 2026Splunk Enterprise Security adds three roles to the default roles provided by Splunk platform.
Now you: objective 1.1 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
You are provisioning a hire who will work Incident Review daily, manage and investigate security incidents, and edit notable events. Which Enterprise Security role do you grant?
Sample question 2 of 3
A security director reviews the Security Posture, Protection Centers and Audit dashboards each morning. Which activity sits outside the documented scope of that role?
Sample question 3 of 3
An administrator wants to assign the ess_admin role directly to a person. What does Splunk document about that?
Full Cybersecurity Defense Analyst question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.