FirstTry
Cybersecurity Defense AnalystSplunk Certified Cybersecurity Defense Analyst

Practice Exam 1

5 of this form’s 66 questions, drawn from across its domains, free. The explanation on every one of them is free too, at every tier, and always will be.

  1. Question 1 of 5

    4-1Investigation, Event Handling, Correlation, and Risk

    A SOC is documenting how incidents reach its analysts so no route is missed during an on-call handover. Which routes deliver notice of an incident needing investigation?

  2. Question 2 of 5

    5-2SPL and Efficient Searching

    An analyst runs a rare-event search against a very large index and finds it slow. Which term does Splunk use for that kind of search?

  3. Question 3 of 5

    3-2Defenses, Data Sources, and SIEM Best Practices

    An Enterprise Security deployment pulls host records from a CMDB and user records from Active Directory into its asset and identity framework. What does that framework do with them?

  4. Question 4 of 5

    1-3The Cyber Landscape, Frameworks, and Standards

    You are writing a risk management program for an information system and need the three activities NIST includes in that process. Which set do you build around?

  5. Question 5 of 5

    2-4Threat and Attack Types, Motivations, and Tactics

    An engineer adds a custom framework under Unmanaged Annotations. What does Splunk say will not happen to it?

0 of 66 completed

0%

The other 61 questions are the rest of this form: same 75 minute clock, same 750 cut score, and the same explanation on every question, which is never behind the wall. Practice Exam 1 of 2 on Cybersecurity Defense Analyst.

What this exam covers

  • The Cyber Landscape, Frameworks, and Standards7 questions / 10% of the exam
  • Threat and Attack Types, Motivations, and Tactics13 questions / 20% of the exam
  • Defenses, Data Sources, and SIEM Best Practices13 questions / 20% of the exam
  • Investigation, Event Handling, Correlation, and Risk13 questions / 20% of the exam
  • SPL and Efficient Searching13 questions / 20% of the exam
  • Threat Hunting and Remediation7 questions / 10% of the exam

Checking what you already have access to.

Every question is original, written from the published objectives. We never reproduce, paraphrase, or imitate real exam content, and neither should anything else you study from.