Objective 3.1
Cybersecurity Defense EngineerResearch, incorporate and develop threat intelligence
Objective 3.1 sits in Building Effective Security Processes and Programs, which carries 20% of the Cybersecurity Defense Engineer exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An engineer asks what adding threat intelligence to Enterprise Security is for. Which purpose does Splunk document?
Correct.
Checked against help.splunk.com, August 2026Concept
Intelligence is context rather than detection. It tells you that an address you already saw has been seen elsewhere doing something worse.
Why C
Splunk documents adding threat intelligence to correlate indicators of suspicious activity, known threats or potential threats with your events.
Source
Splunk Docs: Add threat intelligence to Splunk Enterprise Security, checked August 2026As an ES administrator, you can correlate indicators of suspicious activity, known threats, or potential threats with your events by adding threat intelligence to Splunk Enterprise Security.
Now you: objective 3.1 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
An engineer lists the ways an administrator can add threat intelligence to Enterprise Security. Which set does Splunk document?
Sample question 2 of 3
An engineer asks which STIX versions the Enterprise Security interface accepts directly. Which set does Splunk document?
Sample question 3 of 3
An engineer uploads STIX 2.1 and finds indicator patterns are not picked up. What does Splunk document about that?
Full Cybersecurity Defense Engineer question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.