How can feedback loops improve detections over time?

By keeping detections static to avoid changes

By removing detections that generate any alerts

By using operational data to refine detection logic

By relying solely on vendor updates

How can collaboration between security and development teams improve detection quality?

By having security teams only review after deployment

By keeping security and development processes completely separate

By sharing knowledge and aligning on requirements

By having development teams write all detections

A security team is using Git to manage their detection rules. They want to ensure that the main branch always contains stable, tested rules. Which branching strategy should they use?

Use a release branch only, and never merge back to main.

Use a trunk-based development with short-lived branches and direct commits to main.

Use a feature branch workflow where changes are developed in separate branches and merged into main via pull request after testing.

Use a single branch where all developers commit directly.

A security team wants to improve the quality of their detection rules by having both security analysts and software developers review changes. They want the review process to be formal and recorded. Which workflow should they implement?

Use a pull request workflow in Git where changes are reviewed by at least one security analyst and one developer before merging.

Have the detection author self-review and then merge the change.

Use a shared spreadsheet to list changes and have reviewers sign off manually.

Use an informal chat channel where analysts and developers discuss changes before they are committed.

A security team is adopting detection as code. They want to ensure that every change to a detection rule is reviewed by another analyst before it is merged into the main branch. They also want to automatically run a syntax check and a test against sample data for each proposed change. Which combination of practices should they implement?

Use a Git branch with a pull request workflow, and configure a CI pipeline that runs validation tests on the branch before merge.

Use a ticketing system to track changes and have a senior analyst manually review the final detection after deployment.

Use a version control system but rely on manual testing by the author before each commit.

Use a shared repository where all analysts can push directly to the main branch, and run tests only after the merge.

SplunkCertified Cybersecurity Defense Architect

Domain 5Objective 1

Develop Scalable Strategies for Agile and DevOps-driven Cybersecurity Defenses, Such as Detection as Code. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Part of the Scaling Cybersecurity Defenses and DevSecOps domain, which accounts for 15% of the CYBERSECURITY-DEFENSE-ARCHITECT exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

8concepts

15%of the exam

Questions 16–20

16foundation · easy
How can feedback loops improve detections over time?
Select an answer first
17foundation · easy
How can collaboration between security and development teams improve detection quality?
Select an answer first
18application · medium
A security team is using Git to manage their detection rules. They want to ensure that the main branch always contains stable, tested rules. Which branching strategy should they use?
Select an answer first
19application · medium
A security team wants to improve the quality of their detection rules by having both security analysts and software developers review changes. They want the review process to be formal and recorded. Which workflow should they implement?
Select an answer first
20application · medium
A security team is adopting detection as code. They want to ensure that every change to a detection rule is reviewed by another analyst before it is merged into the main branch. They also want to automatically run a syntax check and a test against sample data for each proposed change. Which combination of practices should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-DEFENSE-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ARCHITECT” is a trademark of its owner, used for identification only.