A company uses Splunk Enterprise Security for detection and Splunk SOAR for response. They want to integrate both with a new endpoint detection and response (EDR) tool. The EDR tool provides a REST API for querying and taking actions, and it also sends syslog alerts. What is the most appropriate way to use each platform's integration capabilities?

Use SOAR to ingest the syslog alerts and use ES to query the EDR API for actions.

Use SOAR to ingest syslog alerts and also query the EDR API, then send all data to ES for storage.

Use ES to query the EDR API directly for all data and actions, bypassing SOAR.

Use ES to ingest the syslog alerts via a forwarder, and use SOAR to query the EDR API and take actions via a playbook.

In Splunk SOAR, what is a playbook?

A type of alert that triggers a notification

A visual representation of an automated incident response workflow

A data model for normalizing security events

A collection of correlation searches

How does SOAR's automation approach differ from Enterprise Security's?

Both use the same automation mechanisms

SOAR uses adaptive response actions, while Enterprise Security uses playbooks

SOAR uses correlation searches to detect threats, while Enterprise Security uses playbooks

SOAR uses workflow-driven playbooks, while Enterprise Security uses event-driven correlation searches

Which of the following is a valid method to validate that a SOAR playbook is working as intended?

Run the playbook in a test environment and verify the actions execute correctly

Check the correlation search results for the playbook

Confirm that the playbook is listed in the Enterprise Security dashboard

Review the data model for the playbook

Which of the following is an example of an adaptive response action in Enterprise Security?

Creating a new data input for a log source

Running a correlation search every 5 minutes

Building a new dashboard for analysts

Blocking an IP address on a firewall

SplunkCertified Cybersecurity Defense Engineer

Domain 4Objective 5

Compare and Validate Integrations and Automation Capabilities of Enterprise Security and SOAR. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 4)

Part of the Automation and Efficiency domain, which accounts for 20% of the CYBERSECURITY-DEFENSE-ENGINEER exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

7concepts

20%of the exam

Questions 16–20

16application · medium
A company uses Splunk Enterprise Security for detection and Splunk SOAR for response. They want to integrate both with a new endpoint detection and response (EDR) tool. The EDR tool provides a REST API for querying and taking actions, and it also sends syslog alerts. What is the most appropriate way to use each platform's integration capabilities?
Select an answer first
17foundation · easy
In Splunk SOAR, what is a playbook?
Select an answer first
18foundation · easy
How does SOAR's automation approach differ from Enterprise Security's?
Select an answer first
19foundation · easy
Which of the following is a valid method to validate that a SOAR playbook is working as intended?
Select an answer first
20foundation · easy
Which of the following is an example of an adaptive response action in Enterprise Security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-DEFENSE-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ENGINEER” is a trademark of its owner, used for identification only.