Which identity directory service is commonly used in Windows environments to store user accounts, group memberships, and authentication data for domain-joined systems?

Security Assertion Markup Language (SAML)

Lightweight Directory Access Protocol (LDAP)

Remote Authentication Dial-In User Service (RADIUS)

A security analyst is investigating a potential advanced persistent threat (APT) that may have been present for months. They have access to firewall logs, APM traces, and infrastructure monitoring metrics. Which data source would be most useful to identify the initial entry point?

Infrastructure monitoring metrics

A security team is planning a vulnerability remediation effort and needs to know which devices are affected by a specific vulnerability and which department owns them. Which data source combination would provide this information?

Firewall logs and identity directory

Identity directory and vulnerability scanner

Vulnerability scanner and asset management system

Observability metrics and firewall logs

Which type of cybersecurity event source is primarily responsible for generating logs that document allowed and denied network traffic based on security policies?

Endpoint detection and response (EDR) agent

SplunkCertified Cybersecurity Defense Architect

Domain 2Objective 2

Identify Data Sources Critical to Cybersecurity Operations, Such as Event Sources, Identity Directories, Asset Management Systems, and Vulnerability - Assessments. This Can Include Non-Security Data Sources, Eg. Observability Tools. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Part of the Security Data Management domain, which accounts for 20% of the CYBERSECURITY-DEFENSE-ARCHITECT exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

6concepts

20%of the exam

Questions 1–5

1application · medium
A security analyst is investigating a potential malware outbreak and needs to identify all devices that have a specific software version installed. Which data source would provide the most accurate and comprehensive answer?
Select an answer first
2foundation · easy
Which identity directory service is commonly used in Windows environments to store user accounts, group memberships, and authentication data for domain-joined systems?
Select an answer first
3expert · hard
A security analyst is investigating a potential advanced persistent threat (APT) that may have been present for months. They have access to firewall logs, APM traces, and infrastructure monitoring metrics. Which data source would be most useful to identify the initial entry point?
Select an answer first
4application · medium
A security team is planning a vulnerability remediation effort and needs to know which devices are affected by a specific vulnerability and which department owns them. Which data source combination would provide this information?
Select an answer first
5foundation · easy
Which type of cybersecurity event source is primarily responsible for generating logs that document allowed and denied network traffic based on security policies?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-DEFENSE-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ARCHITECT” is a trademark of its owner, used for identification only.