Splunk Certified Cybersecurity Defense Engineer

Here you have the best Splunk SPLK-5002 practice exam questions

You have 91 total questions to study from
Each page has 5 questions, making a total of 19 pages
You can navigate through the pages using the buttons at the bottom
This questions were last updated on December 26, 2025
This site is not affiliated with or endorsed by Splunk.

Question 1 of 91

Which of the following is a reason to utilize ES risk framework as a part of detection building?

Create a feedback loop into threat intelligence to identify potential insider threats.

Help accelerate the run time of detections, allowing a faster mean time to detection.

Simplify SOAR automation and remediation, lowering the mean time to recover.

Help prioritize security findings based on their potential business impact.

Correct Answer: D

Question 2 of 91

When creating a case in Splunk SOAR, which action should be taken to correlate various findings (risk notables) to ensure all are actioned?

Search Splunk Enterprise Security for similar or duplicate events based on the threat_object field in a risk notable.

Search Splunk Enterprise Security for all related events based on key fields in a notable and select how to process the results to decide which events to merge into the current investigation.

Search Splunk Enterprise Security for similar or duplicate events based on the risk_object field in a risk notable.

Search Splunk Enterprise Security for all related events based on key fields in a risk notable and select how to process the results to decide which events to merge into the current investigation.

Correct Answer: D

Question 3 of 91

Consider the following series of events:
4:00 GMT Detection runs for interval 3:30-4:00
4:30 GMT Detection runs for interval 4:00-4:30
4:35 GMT Event 1 occurs on an endpoint
4:45 GMT Event 1 is indexed
5:00 GMT Detection runs for interval 4:30-5:00
5:05 GMT Event 1 finding is added to ES with timestamp 4:35
5:24 GMT Event 2 occurs on an endpoint
5:30 GMT Detection runs for interval 5:00-5:30
5:35 GMT Event 2 is indexed
6:00 GMT Detection runs for interval 5:30-6:00
What is the problem with the detection schedule chosen and how can it be solved?

The time window for the detection is too large, causing duplicate alerts.

The logs are delayed so the detection time window needs to be increased.

The time window for the detection is too small, causing duplicate alerts.

The logs are delayed so the detection time window needs to be decreased.

Correct Answer: B

Question 4 of 91

An effective method for building automation workflows is to follow the OODA (Observe, Orient, Decide, Act) loop stages. When transitioning between the Decide and Act stages, what additional work should be included before automating the Act stage?

Create a new response template.

Validate if the asset, identity, or service has an exemption.

Validate response data paths from Decide stage.

Create a new automation playbook.

Correct Answer: B

Question 5 of 91

What is the best method to operationalize the results of a threat hunt for daily use by SOC analysts?

Communicate findings based on the hunt.

Create monthly reports based on the documented findings.

Create detections based on the documented findings.

Communicate gaps to the architecture team.

Correct Answer: C