Objective 8.2
Cybersecurity Defense ArchitectDetermine how coverage gaps can be mitigated by architecture changes, config changes, or process changes
Objective 8.2 sits in Security Capability Selection, Placement, Configuration, which carries 15% of the Cybersecurity Defense Architect exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
Your cloud infrastructure logs arrive with missing fields, and several detections that depend on them never fire. Which cause of the gap does Splunk name first?
Correct.
Checked against help.splunk.com, August 2026Concept
Most gaps close with an onboarding change rather than a new rule. Diagnosing the cause decides whether the fix is configuration or engineering.
Why C
Splunk documents that issues such as mis-configured data collection can lead to detection gaps, so log sources should be reviewed for correct ingestion.
Source
Splunk Docs: Identify optimal detections using Detection studio in Splunk Enterprise Security, checked August 2026Issues such as mis-configured data collection can lead to detection gaps.
Now you: objective 8.2 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
You review a detection set where one rule floods the queue with benign activity and another lets real intrusions pass. Which two failure modes are those?
Sample question 2 of 3
Detection studio must show that your deployed detections cover a wide range of adversary tactics and techniques. Which framework does Splunk name for that mapping?
Sample question 3 of 3
An analyst in Detection studio wants to drill into the individual techniques a detection uses and see the data sources behind them. Which component does that?
Full Cybersecurity Defense Architect question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.
More objectives in Security Capability Selection, Placement, Configuration
- 8.1 Identify organizational coverage for prevention, detection, response and recovery capabilities
- 8.3 Affect organizational and company priorities and budgets based on key capabilities required for security that are aligned to security and business goals
- 8.4 Explain methodologies used to select security technologies aligned to business need, organizational technology landscape, and security controls
- 8.5 Define technology implementation strategies to provide desired capabilities
- 8.6 Ensure that resilient solutions aligned to the business and operational requirements are selected and deployed. -