A correlation search triggers a notable event every time a specific file hash is detected on any endpoint. The same file hash is often detected on multiple endpoints simultaneously during a malware outbreak, creating a flood of events. The analyst wants to generate a single notable event for the file hash, regardless of how many endpoints are affected. Which configuration should be used?

Add a `stats count by file_hash` command to the search and trigger only when count is greater than 1.

Set the correlation search to run once per day and use `dedup file_hash` in the search.

Enable 'Throttle' and set the throttle key to `file_hash` with a throttle period of 24 hours.

Enable 'Suppress' and set the suppression key to `file_hash` with a suppression period of 24 hours.

Which of the following is a technique used to tune a correlation search to reduce false positives?

Adding additional filtering conditions to the search

Increasing the search schedule to run every minute

Which of the following is a common method to suppress duplicate notable events?

Deleting the correlation search after it runs

Setting a suppression window based on a time period or a specific field value

Changing the index where the events are stored

Increasing the search schedule frequency

A correlation search detects potential data exfiltration by flagging large outbound transfers. The SOC wants to prioritize these events in the Incident Review queue. The analyst needs to configure the notable event attributes so that high-risk events (e.g., involving sensitive data) appear at the top of the queue. Which attribute configuration is most important for this prioritization?

Set the 'Owner' attribute to the senior analyst for all events.

Set the 'Urgency' attribute to 'high' for all events.

Set the 'Severity' attribute to 'high' for events involving sensitive data and 'medium' for other events.

Set the 'Status' attribute to 'New' for all events.

SplunkCertified Cybersecurity Defense Engineer

Domain 2Objective 4

Generate Effective Notable Events/findings. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 3)

Part of the Detection Engineering domain, which accounts for 40% of the CYBERSECURITY-DEFENSE-ENGINEER exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~12–20 in this domain), expect 2–4 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

10concepts

40%of the exam

Questions 11–15

11application · medium
A correlation search triggers a notable event every time a specific file hash is detected on any endpoint. The same file hash is often detected on multiple endpoints simultaneously during a malware outbreak, creating a flood of events. The analyst wants to generate a single notable event for the file hash, regardless of how many endpoints are affected. Which configuration should be used?
Select an answer first
12foundation · easy
Which of the following is a technique used to tune a correlation search to reduce false positives?
Select an answer first
13foundation · easy
Which of the following is a common method to suppress duplicate notable events?
Select an answer first
14application · medium
A correlation search detects potential data exfiltration by flagging large outbound transfers. The SOC wants to prioritize these events in the Incident Review queue. The analyst needs to configure the notable event attributes so that high-risk events (e.g., involving sensitive data) appear at the top of the queue. Which attribute configuration is most important for this prioritization?
Select an answer first
15foundation · easy
In Splunk Enterprise Security, which interface is used to review and manage notable events?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-DEFENSE-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ENGINEER” is a trademark of its owner, used for identification only.

Generate Effective Notable Events/findings. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 3)

Questions 11–15

Which of the following is a technique used to tune a correlation search to reduce false positives?

Which of the following is a common method to suppress duplicate notable events?

In Splunk Enterprise Security, which interface is used to review and manage notable events?

Keep studying — Detection Engineering