Splunk Certified Cybersecurity Defense Engineer
Last Update Oct 12, 2026
Total Questions : 105
We are offering FREE SPLK-5002 Splunk exam questions. All you do is to just go and sign up. Give your details, prepare SPLK-5002 free exam questions and then go for complete pool of Splunk Certified Cybersecurity Defense Engineer test questions that will help you more.
Which of the following is the most efficient search to return a list of all visible indexes and the sourcetypes contained within them?
Which of the following macro values will exclude all of the company networks if it is called from the following search?
index=firewall sourcetype=pan\:traffic NOT " company_networks "
An engineer needs to create a new report capturing the vendors and products that detect a particular CVE in their environment. How can they ensure that the search associated with the report only includes accelerated data?
Which of the following should be the primary reference when designing a new playbook in Splunk SOAR?
In Enterprise Security, what is the name of the threat intelligence lookup pertaining to files?
An engineer is writing a correlation search and needs to use T1059 from MITRE ATT & CK as a field in Incident Review. Assuming they are writing a correlation search that does not use the Risk data model, which example statement should be appended to the correlation search?
The SOC manager has a desire to measure mean time to acknowledge finding (notable event) in order to meet a desired service-level objective. Which two fields can be used to measure the difference?
Risk scores are associated with how many levels of risk in Enterprise Security by default?
Which Splunk Enterprise Security add-on facilitates the ingestion of Threat Intelligence data?
The following SPL is designed to report on a certain SOC metric. Which metric is the most likely topic for this report?
| tstats summariesonly=true earliest(_time) as _time
FROM datamodel=Incident_Management
BY " Notable_Events.Meta.rule_id "
| rename " Notable_Events.Meta.* " as " * "
| lookup update=true incident_updates_lookup rule_id OUTPUTNEW time
| search time=*
| stats earliest(_time) as create_time, min(time) as triage_time by rule_id
| eval diff=triage_time-create_time,
stat_type=if(
create_time < relative_time(now(), " -7d@d " ),
" past " ,
" current "
),
past=if(stat_type= " past " , 1, 0),
current=if(stat_type= " current " , 1, 0),
past_diff=if(stat_type= " past " , diff, 0),
current_diff=if(stat_type= " current " , diff, 0)
| stats sum(past) AS past,
sum(current) AS current,
sum(past_diff) AS past_diff,
sum(current_diff) AS current_diff
| eval past=round(past_diff/past/60),
current=round(current_diff/current/60)
| table past, current
| transpose
What field is used by default to direct data into CIM data model datasets?
When setting Common Information Model (CIM) accelerations, which parameter should be defined to set how far back in time (specified as a relative time string) the Splunk platform creates its column stores?
Which REST call will show a list of alerts with their specific commands, app, and title?
Which syntax is correct to create two new rows on an existing threat intelligence collection?
A detection engineer is using a threat defense informed strategy to define use cases. Which Splunk app would best facilitate their use case development process by cross referencing detections with the MITRE ATT & CK Framework?
MITRE D3FEND is designed to compliment MITRE ' s list of adversarial tactics, techniques, and common knowledge (ATT & CK). Which tactics are associated with MITRE D3FEND in order to detect, deny, and disrupt adversarial efforts?
A SOC ' s Incident Response Standard Operating Procedure (SOP) calls for any phishing emails containing files to be detonated in Splunk Attack Analyzer for evaluation. Which of the following can an engineer implement to gain efficiency through automation?
Which of the following can process data from configured containers using an automated sequence of actions?
An engineer notices that a detection is creating multiple Findings (notables) for the same potential incident. Which setting can be adjusted to reduce the number of generated findings (notables)?
How does Mission Control decipher which response template to assign to findings?
An EDR tool was recently purchased and needs to be integrated into existing Splunk SOAR playbooks. Which actions are typically associated with this type of asset?
An engineer has been working on building a new automation for the SOC. What Scope should be selected in the SOAR Playbook Debugger during the playbook development to ensure consistency?
What is one method used in ESCU content to calculate a risk score when creating a detection that uses the Risk Analysis adaptive response action?
What does the following search do?
source=WinEventLog:security* sourcetype= " WinEventLog* " EventCode=4688
| stats count, values(process) as process by parent_process_name
Which tool can help identify known tactics, techniques, and procedures that a threat group is most likely to use when targeting a financial organization?
Which Splunk feature makes SPL searches shorter and reusable by inserting it into search strings?
In a Risk-Based Alerting implementation with Splunk Enterprise Security, which of the following best describes a risk factor?
Consider the following series of events:
4:00 GMT Detection runs for interval 3:30–4:00
4:30 GMT Detection runs for interval 4:00–4:30
4:35 GMT Event 1 occurs on an endpoint
4:45 GMT Event 1 is indexed
5:00 GMT Detection runs for interval 4:30–5:00
5:05 GMT Event 1 finding is added to ES with timestamp 4:35
5:24 GMT Event 2 occurs on an endpoint
5:30 GMT Detection runs for interval 5:00–5:30
5:35 GMT Event 2 is indexed
6:00 GMT Detection runs for interval 5:30–6:00
What is the problem with the detection schedule chosen and how can it be solved?
When creating a detection, how might an engineer ensure that all possible contextual fields about a given asset and identity are added to a risk event?
A detection engineer is using a threat defense informed strategy to define use cases. Which Splunk app would best facilitate their use case development process by cross referencing detections with the MITRE ATT & CK Framework?
TESTED 12 Oct 2026
