SPLK-5002 Splunk Certified Cybersecurity Defense Engineer Free Practice Exam Questions (2026 Updated)

Windows Security Event ID 4740 records the condition “A user account was locked out.” Consequently, a detection that counts EventCode 4740 events and aggregates them by user is specifically measuring repeated account-lockout activity. The appropriate detection is therefore Detect Excessive User Account Lockouts .

From a detection-engineering perspective, a useful analytic would establish a baseline or threshold and then aggregate by the affected account, for example conceptually using stats count by user. A high number of lockouts may indicate password spraying, credential-stuffing activity, an incorrectly configured service using stale credentials, or an automated process repeatedly authenticating with an invalid password. Context such as source workstation, account type, time window, and historical frequency would improve fidelity.

The distractors represent different telemetry classes. Excessive successful or failed logins normally involve authentication events such as 4624/4625 rather than 4740. Network-connection detections require network or endpoint connection telemetry, and AWS security scanning is unrelated to Windows account-lockout auditing.

The supplied material presents EventCode 4740 specifically in this detection-selection context on page 3.

Study Guide topics: Windows security telemetry, EventCode-based analytics, aggregation, account lockouts, authentication detections, threshold-based detection engineering.

A total count of blocked firewall connections describes an outcome generated by the control , rather than measuring how effectively the firewall itself performs against an established operational objective. It is therefore better characterized as a Key Result Indicator (KRI) in the terminology used by the course material.

For example, observing five million blocked connections does not demonstrate that a firewall is performing better than one that blocks one million. The total is heavily influenced by external conditions such as Internet scanning, bot activity, exposure of public services, and changing adversary traffic. The number can increase even when no improvement has occurred in firewall configuration, reliability, policy quality, or security effectiveness.

A meaningful KPI should connect directly to measurable performance—for example control availability, policy deployment accuracy, remediation time, rule-review compliance, or another defined operational objective. Firewall-block volume may remain useful as contextual or trend information, but treating it as a performance metric can produce misleading conclusions about security-program effectiveness.

The supplied study material contains this firewall KPI/KRI distinction.

Study Guide topics: security metrics, KPI versus KRI, control effectiveness, perimeter security, security-program reporting.

Splunk uses Analytic Stories to organize related detections around a common threat scenario, adversary behavior, or security use case. Ransomware is an ideal example because no single detection fully characterizes the attack. Instead, defenders may observe multiple behaviors representing different stages or consequences of the intrusion.

One analytic could detect registry modifications associated with persistence or configuration changes. Another could identify mass creation of ransom-note files. A separate detection could monitor wallpaper modification or account manipulation. An Analytic Story groups these related analytics into a coherent defensive narrative so engineers and analysts can understand how individual detections collectively provide coverage of the broader threat.

A data model normalizes telemetry and enables consistent searching but does not conceptually group detections by attack scenario. The Threat Intelligence Framework handles indicators and intelligence enrichment, while the Assets & Identities Framework adds contextual information about entities. Neither serves as the security-content grouping mechanism described.

Analytic Stories also help communicate detection coverage, supporting searches, data requirements, and related adversary techniques in a structured way.

Study Guide topics: Analytic Stories, ransomware detection, security-content organization, detection coverage, behavioral analytics, MITRE ATT & CK alignment.

The key-value pairs appearing after the ? character in a URL are parameters , more specifically query parameters . The example structure shown in the supplied material follows the standard pattern:

?type=hash & data= < value >

Here, type=hash and data= < value > are query parameters. The question mark marks the beginning of the URL ' s query component, while an ampersand ( & ) separates multiple parameter pairs. Each parameter typically consists of a key followed by = and its corresponding value.

This must be distinguished from an HTTP payload , which is normally transmitted in the request body, particularly with operations such as POST or PUT. Headers are separate HTTP metadata elements containing information such as authorization credentials, content type, accepted response formats, and user-agent information. “KV Elements” is not the HTTP/REST terminology for the URL query component.

Understanding this distinction is important when configuring SOAR integrations because an API may require values in different locations. Supplying a required query parameter in the request body—or vice versa—can result in validation failures even when the correct data is present.

Study Guide topics: REST APIs; query parameters; HTTP requests; SOAR integrations; URL structure; API troubleshooting.

The relevant field is orig_sid , which identifies the original Splunk search job associated with the correlation search that generated the notable event. This field is valuable when a detection engineer needs to troubleshoot how a notable was produced and correlate the downstream event with its originating search execution.

Splunk searches are associated with search IDs, commonly referred to as SIDs. When an adaptive response action produces a notable, maintaining a reference to the originating SID provides traceability from the analyst-visible security object back to the search job that generated it. An engineer can use this information while examining search execution, returned results, timing behavior, field generation, or unexpected notable creation.

This is particularly important when diagnosing issues such as incorrect correlation-search results, unexpected fields, duplicate findings, search scheduling problems, or adaptive-response behavior. Without the original search reference, reconstructing the exact execution context becomes substantially more difficult.

The distractor fields risk_sid, search_sid, and result_sid do not represent the specific originating correlation-search identifier requested by the item.

Study Guide topics: correlation searches; adaptive response actions; notable-event troubleshooting; search IDs; orig_sid; detection traceability.

The defensive tactic set represented in the question is Harden, Detect, Isolate, Deceive, and Evict . These concepts describe defensive objectives that complement the adversary-centered behaviors cataloged through MITRE ATT & CK.

Harden concerns increasing resistance to adversary activity before or during attack execution. Detect focuses on identifying malicious behavior or artifacts. Isolate limits an adversary ' s ability to interact with systems, resources, or other components. Deceive employs defensive deception to influence adversary perception or behavior. Evict addresses removing adversarial presence and associated effects from the defended environment.

This complements ATT & CK conceptually: ATT & CK helps defenders describe what adversaries do, while D3FEND structures defensive countermeasure knowledge. For a detection engineer, the pairing can improve security-program design by connecting observable adversary techniques with candidate defensive approaches rather than viewing detection as an isolated control.

The alternative choices contain terms that are not part of the tactic combination tested in the supplied question, such as Enrich, Define, Exhaust, and Eradicate.

Study Guide topics: MITRE D3FEND, MITRE ATT & CK, defensive tactics, security architecture, detection and response strategy.

The search retrieves Windows Security events with EventCode 4688 , which represents process creation, and then aggregates the results by parent_process_name. The stats clause calculates a count and uses values(process) to return the distinct child process values associated with each parent process. Of the supplied choices, this is best described as displaying processes and their parent processes .

The decisive SPL is:

stats count, values(process) as process by parent_process_name

The by parent_process_name clause creates result groups based on each parent process. Within every group, values(process) builds the set of process values associated with that parent. count additionally records how many qualifying events occurred within the group.

The search does not group by user, so options A and B do not describe its result structure. Option C reverses the relationship: the grouping key is the parent rather than the child process.

This type of aggregation can help detection engineers identify unusual parent-child process relationships—for example, a normally benign application unexpectedly spawning a command interpreter.

Study Guide topics: SPL stats, values(), Windows EventCode 4688, parent-child process analysis, endpoint detections.

The default mechanism represented by the question is the tag field. CIM data-model datasets use constraints that commonly depend on tags applied through event types and other Splunk knowledge objects to determine whether events belong to a particular semantic dataset.

For example, events associated with a particular CIM category can be tagged so that the corresponding dataset constraint recognizes them. The underlying vendor data may originate from many different sourcetypes, but the CIM abstraction allows all correctly classified and normalized records to participate in a common data model.

A sourcetype remains extremely important because it identifies the format and parsing context of indexed data, but CIM is intentionally designed to support multiple vendors and sourcetypes within the same semantic dataset. Consequently, sourcetype alone is not the default abstraction requested here. source identifies the origin of data and similarly does not define CIM dataset membership. dataset is not the event field used by default for this routing behavior.

Correct tagging must be combined with proper CIM field normalization for downstream searches to produce meaningful standardized results.

Study Guide topics: CIM tags, dataset constraints, event types, CIM normalization, data-model membership, sourcetypes.

The Enterprise Security threat-intelligence lookup associated with file-based intelligence is file_intel .

Splunk Enterprise Security organizes threat-intelligence indicators according to observable type. This allows the Threat Intelligence Framework to normalize and match compatible indicators against event telemetry. File-oriented intelligence can contain characteristics such as file hashes, file names, or other file-related observables used to identify known malicious artifacts.

The naming convention is important. file_hash describes a type of file indicator but is not the threat-intelligence lookup name requested by the question. user_intel and user_hash concern user-oriented naming and do not correspond to the file intelligence collection.

The supplied study material demonstrates the same Threat Intelligence Framework design by asking which intelligence KV store contains malicious FQDNs, reinforcing that ES separates intelligence into purpose-specific collections such as service_intel. The exact file_intel question is not shown verbatim in the uploaded 60-question set, but the collection naming and threat-intelligence architecture are consistent with the framework tested there.

Study Guide topics: Threat Intelligence Framework, file_intel, file indicators, IOC normalization, threat matching, KV Store intelligence collections.

EventCode 4104 represents PowerShell Script Block Logging , making it the relevant telemetry for inspecting PowerShell code executed in an environment. The question specifically ties the detection requirement to PowerShell Script Block Logging and therefore directly points to 4104.

Script Block Logging provides visibility into PowerShell script content after PowerShell has processed the command or script block. From a detection-engineering perspective, this can expose suspicious commands, modules, functions, credential-access behavior, encoded or obfuscated PowerShell content, and scripts associated with offensive frameworks. An engineer can search this telemetry for characteristics associated with the behavior discovered during the red-team exercise and subsequently operationalize reliable indicators into a detection.

EventCode 4624 , by comparison, represents a successful Windows logon and can be useful in authentication and lateral-movement analysis, but it is not the PowerShell Script Block Logging event explicitly requested. The remaining distractor event codes do not represent the logging mechanism identified in the question.

The distinction matters because endpoint detections depend on selecting telemetry that observes the relevant layer of attacker behavior. Here, PowerShell execution content—not merely authentication—is the required visibility source.

Study Guide topics: PowerShell logging, EventCode 4104, endpoint telemetry, behavioral detection, red-team findings, Windows security monitoring.

Applying suppression rules for false positives improves the operational effectiveness of Enterprise Security notable events because it reduces repetitive or known-benign findings that would otherwise consume analyst attention. Effective detection engineering is not measured simply by how many notables are generated; it is measured by whether the resulting findings are sufficiently relevant, actionable, and prioritized for investigation.

Suppression can prevent repeated findings that match defined conditions during a configured period. For example, a known administrative process, sanctioned vulnerability scanner, or repeatedly detected condition may be excluded or suppressed when its behavior has already been validated. The supplied material reinforces this principle through its discussion of correlation-search throttling , where repeated findings for the same potential incident are reduced rather than continually presented to analysts.

Limiting a search to one index can unnecessarily exclude relevant telemetry. Using only raw logs sacrifices the benefits of CIM, accelerated data models, and normalized fields. Disabling scheduled searches would prevent recurring correlation searches from identifying new suspicious activity.

Study Guide topics: correlation-search tuning, throttling/suppression, false-positive reduction, notable-event quality, analyst workload, detection effectiveness.

The correct REST endpoint is:

| rest /servicesNS/admin/-/alerts/alert_actions

| table title, eai:acl.app, label, payload_format, command

The path component alerts/alert_actions is the key indicator. It queries Splunk ' s alert-action resources, allowing the search to enumerate configured alert actions and expose metadata describing each action.

The namespace syntax is also significant. servicesNS/admin/-/ requests resources in the admin user namespace across applications, while eai:acl.app identifies the app context associated with the returned object. The subsequent table command limits the output to useful fields including the alert-action title, application, label, payload format, and underlying command.

Options C and D use the incorrect path actions/alert_actions. Option B uses a literal user namespace rather than the administrative namespace represented by the expected command.

The uploaded study guide covers REST usage, alert/adaptive-response concepts, and API interaction, but it does not expose this exact REST endpoint verbatim in its parsed text. The answer above follows the Splunk REST resource structure tested by the question.

Study Guide topics: Splunk REST API, | rest, alert actions, namespaces, eai:acl.app, adaptive response, administrative inspection.

The preferred approach is tstats , because tstats operates against indexed metadata rather than requiring Splunk to retrieve and process every matching raw event. A conceptual implementation is:

| tstats values(sourcetype) WHERE index=* BY index

This produces one result per visible index and lists the sourcetypes associated with each index. It is significantly more efficient than executing:

index=* | stats ...

because the latter can require broad raw-event retrieval across every searchable index. In a large security deployment containing billions of events, that difference is operationally significant.

The tstats command is particularly useful when the required information can be derived from indexed fields or accelerated data structures. Here, both index and sourcetype information can be obtained without inspecting full _raw event payloads.

The phrase " most efficient " is therefore central to the question. Several approaches may theoretically obtain similar information, but a broad raw-event search is unnecessarily expensive when indexed metadata already contains what is required.

This question appears on page 2 of the supplied material.

Study Guide topics: SPL efficiency, tstats, indexed metadata, index discovery, sourcetype inventory, search optimization.

The correct collection is service_intel . Splunk Enterprise Security ' s Threat Intelligence Framework separates indicators into intelligence collections according to the type of observable being represented. Fully Qualified Domain Names are service-oriented network identifiers and are handled through the service intelligence collection in the context tested by this question.

This classification matters because the Threat Intelligence Framework must know which event fields and indicator types can be meaningfully compared. A domain such as malicious.example.com is semantically different from a raw IPv4/IPv6 address, a certificate fingerprint, or a complete HTTP URL. The ip_intel collection is intended for IP-oriented indicators, while certificate_intel deals with certificate-related intelligence. http_intel is associated with HTTP-oriented indicators such as URLs and related HTTP observables rather than the standalone FQDN type being asked about here.

Detection engineering depends on this normalization because matching searches must compare compatible indicator types. Correct placement also supports deduplication, expiration, weighting, threat matching, and downstream enrichment of security findings.

Study Guide topics: Threat Intelligence Framework, KV Store collections, indicator normalization, FQDN intelligence, threat matching, intelligence enrichment.

The correct field is user , because Splunk ' s Common Information Model provides normalized fields that allow heterogeneous security data sources to be queried consistently. Authentication, endpoint, identity, operating-system, and application logs frequently use different native names for the same concept—for example, username, account_name, UserName, or src_user. CIM mappings normalize the appropriate value into the canonical user field.

This becomes particularly important when a detection performs aggregation such as:

| stats count by user

If contributing sources fail to populate user consistently, activity belonging to the same account can be fragmented, omitted, or incorrectly represented in the detection results. action identifies the result or nature of activity rather than the account responsible for it. user_id may occur in individual schemas but is not the general CIM field being tested here. identity represents a different conceptual object and is not the standard aggregation field for this use case.

The question appears on page 1 of the supplied certification material.

Study Guide topics: Common Information Model, CIM normalization, normalized fields, data-model consistency, user attribution, detection data preparation.

The Enterprise Security Risk Framework enables detection engineers to express suspicious observations as risk against meaningful entities—typically users, systems, or other risk objects—and then prioritize those observations according to their security significance. Option C therefore represents the principal value being tested: prioritizing findings based on potential business impact .

In a Risk-Based Alerting design, an individual behavior does not necessarily need to generate an analyst-facing finding immediately. Instead, detections can generate risk events containing fields such as the risk object, risk object type, risk score, and contextual annotations. Multiple risk events can accumulate until correlation logic determines that the combined evidence warrants escalation. Risk Factors and asset/identity context can further modify significance when an affected entity is particularly sensitive or critical.

Risk processing is therefore fundamentally about contextual prioritization and evidence aggregation , not search-performance acceleration. It does not inherently create a threat-intelligence feedback loop, nor is its primary purpose to simplify SOAR execution. Those capabilities can interact with risk-based detections but are separate functions.

Study Guide topics: Enterprise Security Risk Framework; Risk-Based Alerting; risk objects; risk scores; business impact; security finding prioritization.

The appropriate analytic is Excessive DNS Failures . The decisive evidence in the example is the DNS query followed by a SERVFAIL response. SERVFAIL is a DNS response condition indicating that the DNS server was unable to complete the requested resolution successfully. Repeated occurrences therefore represent DNS-resolution failures rather than authentication, endpoint, or generic network failures.

A detection engineer could aggregate these events across an appropriate time window and evaluate dimensions such as source host, queried domain, client, or response code. The objective is to distinguish ordinary occasional resolution failures from anomalous concentrations that warrant investigation.

The example is particularly security-relevant because the queried name resembles a command-and-control domain. However, the detection name requested by the question is driven by the observable pattern in the telemetry: repeated failed DNS resolutions. Such activity can result from misconfiguration, unavailable authoritative infrastructure, transient DNS problems, or suspicious software repeatedly attempting to resolve unavailable infrastructure. Analysts would use additional context to determine the actual cause.

None of the other options corresponds directly to the DNS SERVFAIL evidence shown in the event.

Study Guide topics: DNS telemetry, SERVFAIL, threshold-based detections, network security monitoring, DNS analytics, detection operationalization.

A Risk Factor is best characterized as a multiplier of risk based on contextual characteristics of a specific user or asset . It allows Enterprise Security to adjust the significance of an otherwise identical security observation depending on the entity involved.

Suppose a detection normally produces a risk score representing suspicious authentication behavior. If the affected host is an ordinary workstation, the base score may appropriately represent its significance. If the same activity affects a domain controller, highly sensitive database, privileged administrator, or other critical entity, a Risk Factor can increase the resulting risk so that the situation receives greater analytical priority.

This enables organizations to incorporate business context into Risk-Based Alerting without duplicating detection logic for every asset category. The detection identifies the behavior; the Risk Factor modifies its importance according to contextual conditions.

A Risk Factor is not itself simply another risk event, nor is its purpose to accelerate a data model. It is also unrelated to a SOAR action generated from detection annotations. Its role is contextual adjustment of risk , supporting more meaningful aggregation and escalation.

Study Guide topics: Risk-Based Alerting; Risk Factors; risk multiplication; asset criticality; identity context; risk prioritization.

The existing Standard Operating Procedure (SOP) should be the primary reference when designing a Splunk SOAR playbook. A playbook is fundamentally an automation implementation of an established operational process; therefore, the engineer should first understand the SOC-approved sequence of investigation, enrichment, decision, containment, escalation, and remediation steps before converting suitable portions into automated actions.

The SOP defines what should happen, in what order, under which conditions, and with what human approval requirements . Once that workflow is understood, deterministic and repeatable steps can be automated while judgment-intensive or high-impact actions can retain analyst approval gates. The supplied Cybersecurity Defense Engineer material supports this workflow-oriented design through its coverage of SOPs, Workbooks, response templates, and SOAR playbooks as mechanisms for standardizing and automating analyst processes.

MITRE ATT & CK is valuable for mapping adversary behavior and detection coverage, while CIS provides control guidance. Existing investigation actions may inform implementation, but none replaces the organization ' s approved operating procedure as the authoritative workflow definition.

Study Guide topics: SOPs, SOAR playbooks, workflow automation, Workbooks, response templates, analyst process standardization, automation guardrails.