Certification guide

Cybersecurity Defense Engineer

Splunk Certified Cybersecurity Defense Engineer: the honest guide

Everything Splunk publishes about Cybersecurity Defense Engineer, in one place: what the exam asks, how the domains are weighted, and what it takes to be ready.

This guide page is built from the registry, not written yet.

Everything below comes from Cybersecurity Defense Engineer’s published exam data, and every figure links to the vendor page it came from. The researched version, with study plans and the parts nobody publishes, is still being written. This page is not submitted to search engines until it is.

Practise Cybersecurity Defense Engineer questions in the meantime

What the exam actually asks you to do

60 multiple choice questions and nothing else. Splunk sets no lab and no simulation on this exam, so the practice that matters is reading a scenario and choosing well under the clock.

Item formats

  • Multiple choice

Nothing here needs a lab. Reading carefully and eliminating options is the whole skill. Splunk, Splunk Certified Cybersecurity Defense Engineer certification track

Domain breakdown and official weightings

From the official Splunk certification tracks. Detection Engineering is the heaviest domain at 40 percent, followed by Building Effective Security Processes and Programs at 20 percent.

  • Data Engineering10%
  • Detection Engineering40%
  • Building Effective Security Processes and Programs20%
  • Automation and Efficiency20%
  • Auditing and Reporting on Security Programs10%

Where to focus: Detection Engineering alone is 40% of the exam, which is 24 of the 60 questions. Automation and Efficiency and Building Effective Security Processes are 20% each, so three sections carry 80% of the paper.

Splunk: Splunk certification tracks

What comes after passing

Cybersecurity Defense Engineer is valid for 3 years. All Splunk certifications run a three year life cycle from the date of the highest certification exam passed. Splunk stopped renewing certifications through coursework on 1 March 2026, so renewal now means either retaking the same exam in the final year of the window or earning a higher level certification in the same track. Splunk says a certification you let lapse is marked inactive, and that you then restart the programme at the Splunk Core Certified Power User level.

Costs across the full renewal cycle are on the Cybersecurity Defense Engineer cost page.

Frequently asked questions

How much does the Splunk Certified Cybersecurity Defense Engineer exam cost?

Splunk lists the exam at $130 USD per exam attempt and delivers it through its testing partner Pearson VUE, at a test centre or with an online proctor. A retake costs the same $130 again.

How long is the exam and how many questions does it have?

Splunk publishes 60 multiple choice questions in 75 minutes. Splunk notes on the test blueprint that the 75 minutes include three minutes to review the exam agreement, so the working time is 72.

What is the passing score?

Splunk publishes no passing score for this exam, and no exam code either. It states the question count, the time limit and the section weightings on its test blueprint and stops there, so any percentage you see quoted elsewhere is somebody's estimate rather than Splunk's number.

What do I need before I can sit it?

Splunk lists no prerequisite for this exam. Anyone can register for it.

Keep reading

Every guide and cost breakdown, by vendor

Practise Cybersecurity Defense Engineer for free while you decide

Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.

Start free Cybersecurity Defense Engineer questions