A detection engineer has tuned a correlation search multiple times to reduce false positives. The engineer wants to ensure that future changes are traceable and that the detection remains effective over time. Which practice best supports this goal?

Rely on the Splunk audit log to track changes automatically.

Delete old versions of the search to avoid confusion.

Store the search in a version control system and document each change in a changelog.

Keep the search in a shared folder and update it directly when changes are needed.

A security team wants to detect an attacker who uses a legitimate remote desktop tool to move laterally. The detection should focus on unusual usage patterns, such as connections to multiple hosts in a short time. Which SPL logic best captures this behavior?

Use `stats` to count distinct destination hosts per source user, then alert when the count exceeds a threshold within a time window.

Use `regex` to extract source IPs and alert on any IP that appears more than 5 times.

Use `lookup` to compare against a list of known remote desktop tools and alert on any match.

Use `transaction` to group all remote desktop events per user and alert on any transaction longer than 1 hour.

A correlation search alerts on any single failed login. To reduce false positives, what is the most effective way to use a threshold?

Add a threshold that requires a minimum number of failed logins within a specific time period

Use the 'rare' command to find uncommon failed logins

Change the search to only look at failed logins from external IP addresses

Increase the search window to 24 hours

Why is it important to document the logic of a correlation search?

To meet regulatory requirements for storing all search queries

To ensure the search runs faster by providing comments in the SPL

To automatically update the search when new data sources are added

To provide a reference for other analysts to understand the detection's purpose and logic

What is the purpose of adding an allowlist to a correlation search?

To exclude known benign values from triggering alerts

To increase the speed of the search by limiting the fields searched

To ensure the search only runs on specific indexers

To restrict the search to only include events from a specific time range

SplunkCertified Cybersecurity Defense Engineer

Domain 2Objective 1

Create and Tune Detections (i.e. Correlation Search). CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 3)

Part of the Detection Engineering domain, which accounts for 40% of the CYBERSECURITY-DEFENSE-ENGINEER exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~12–20 in this domain), expect 2–4 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

40%of the exam

Questions 11–15

11application · medium
A detection engineer has tuned a correlation search multiple times to reduce false positives. The engineer wants to ensure that future changes are traceable and that the detection remains effective over time. Which practice best supports this goal?
Select an answer first
12application · medium
A security team wants to detect an attacker who uses a legitimate remote desktop tool to move laterally. The detection should focus on unusual usage patterns, such as connections to multiple hosts in a short time. Which SPL logic best captures this behavior?
Select an answer first
13foundation · easy
A correlation search alerts on any single failed login. To reduce false positives, what is the most effective way to use a threshold?
Select an answer first
14foundation · easy
Why is it important to document the logic of a correlation search?
Select an answer first
15foundation · easy
What is the purpose of adding an allowlist to a correlation search?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-DEFENSE-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ENGINEER” is a trademark of its owner, used for identification only.