Integrate threat intelligence, including all aspects of the lifecycle (evaluation, curation, maintenance, sources, confidence scoring, etc.), into broader security operations

Objective 1.2 sits in Advanced Threat Intelligence and Analysis, which carries 5% of the Cybersecurity Defense Architect exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.

Objective title verbatim from the official objectives. Splunk exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

1-2Advanced Threat Intelligence and AnalysisModerate

An analyst designs a maintenance check for intelligence feeds. Which documented signal confirms a URL-based source is arriving?

The download_status columnCorrect · your answerCorrect.

The threat_activity index countMatch volume can fall for reasons other than a failed download.

The notable event countNotable counts reflect detection rather than feed health.

The risk index volumeRisk index volume measures scoring activity.

Correct.

Checked against help.splunk.com, August 2026

Concept

A feed that silently stops leaves detections quietly blind. Checking arrival separately from matching is what makes that failure visible.

Why A

Splunk documents finding the source on the Threat Intelligence Audit dashboard and confirming that the download_status column states threat list downloaded.

Source

Find the intelligence source and confirm that the download_status column states threat list downloaded.

Splunk Docs: Verify that you have added intelligence successfully, checked August 2026

#threat intelligence#lifecycle

Now you: objective 1.2 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 2

1-2Advanced Threat Intelligence and AnalysisModerate

You upload a threat intelligence file to Enterprise Security, and twenty minutes later its indicators are still absent from the KV Store collections. How often does the modular input that parses intelligence run?

Sample question 2 of 2

1-2Advanced Threat Intelligence and AnalysisEasy

Enterprise Security supports several types of threat intelligence, and you need to know where each supported type is actually stored. What do the supported types correspond to?

Full Cybersecurity Defense Architect question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.