Objective 3.2
Cybersecurity Defense EngineerUse common methodologies for risk and detection prioritization
Objective 3.2 sits in Building Effective Security Processes and Programs, which carries 20% of the Cybersecurity Defense Engineer exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
Two notables from the same correlation search land with different urgency levels, and the urgency_lookup decided both. Which two values does that lookup use?
Correct.
Checked against help.splunk.com, August 2026Concept
Prioritization needs both halves: how bad the finding is, and how much the target matters. Either alone ranks the queue badly.
Why A
Splunk documents that the urgency_lookup determines the urgency level using both the severity and priority values.
Source
Splunk Docs: How urgency is assigned to notable events, checked August 2026The urgency_lookup determines the urgency level by using both the severity and priority value assigned to the notable that is generated from the correlation search and the priority assigned to specific fields in the assets and identities.
Now you: objective 3.2 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A notable names a server rated critical in the asset lookup and a user rated medium in the identity lookup. Which priority feeds the urgency calculation?
Sample question 2 of 3
An engineer edits the urgency lookup and needs a valid priority value. Which one does Splunk document as valid?
Sample question 3 of 3
Several notables reach the queue with an urgency of unknown, and their correlation searches are running normally. What produces that unknown urgency?
Full Cybersecurity Defense Engineer question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.