Objective 8.1
Cybersecurity Defense ArchitectIdentify organizational coverage for prevention, detection, response and recovery capabilities
Objective 8.1 sits in Security Capability Selection, Placement, Configuration, which carries 15% of the Cybersecurity Defense Architect exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An administrator maps organizational coverage using the CSF. What does NIST document the DETECT Function as covering?
Correct.
Checked against nvlpubs.nist.gov, August 2026Concept
Assigning each capability to one function is what turns an estate into a coverage map. Overlap is fine; a function with nothing in it is the finding.
Why B
NIST documents DETECT as where possible cybersecurity attacks and compromises are found and analyzed, enabling timely discovery and analysis of anomalies and indicators of compromise.
Source
NIST CSWP 29: The NIST Cybersecurity Framework (CSF) 2.0, checked August 2026DETECT (DE) - Possible cybersecurity attacks and compromises are found and analyzed. DETECT enables the timely discovery and analysis of anomalies, indicators of compromise, and other potentially adverse events that may indicate that cybersecurity attacks and incidents are occurring.
Now you: objective 8.1 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
You are assigning each step of an incident playbook to a CSF Function, starting with the steps taken while the incident is still live. Which outcomes sit in RESPOND?
Sample question 2 of 3
The malware is eradicated and your plan moves into the CSF RECOVER Function. What does RECOVER support?
Sample question 3 of 3
A new security program first builds an inventory of its data, hardware, systems, facilities and suppliers under CSF IDENTIFY. What does that understanding enable?
Full Cybersecurity Defense Architect question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.
More objectives in Security Capability Selection, Placement, Configuration
- 8.2 Determine how coverage gaps can be mitigated by architecture changes, config changes, or process changes
- 8.3 Affect organizational and company priorities and budgets based on key capabilities required for security that are aligned to security and business goals
- 8.4 Explain methodologies used to select security technologies aligned to business need, organizational technology landscape, and security controls
- 8.5 Define technology implementation strategies to provide desired capabilities
- 8.6 Ensure that resilient solutions aligned to the business and operational requirements are selected and deployed. -