How can contextual data be incorporated into an alert to make it more actionable for a security analyst?

By adding asset owner and criticality fields to the alert

By including the raw log source only

By sending the alert to a generic email list

By reducing the alert to a single field

A correlation search detects anomalous outbound traffic. How can network context be used to set a dynamic threshold?

By setting the threshold based on the time of day only

By using the same threshold for all users

By using a fixed threshold for all assets

By comparing traffic volume to the asset's historical baseline

What is the primary benefit of designing a correlation search that includes contextual data?

It increases the speed of the search

It reduces the amount of data indexed

It eliminates the need for tuning thresholds

It improves detection accuracy by reducing false positives

A security team wants to detect anomalous outbound data transfers. They have a lookup that categorizes each internal asset by its normal data-transfer volume (low, medium, high). Which correlation search design would best reduce false positives while still detecting unusual activity?

Alert on any outbound transfer exceeding 100 MB in a 24-hour period.

Alert when the outbound transfer volume for an asset exceeds its category-specific baseline by a factor of three.

Alert when any asset transfers data to a new external IP address.

Alert when the total outbound transfer volume across all assets exceeds 1 GB in a day.

A correlation search flags every failed login to a domain controller as a potential brute-force attack. How can incorporating asset context reduce false positives?

By adjusting the threshold based on the asset's criticality

By filtering out events that do not match a known asset

By ignoring failed logins from non-critical assets

By correlating with asset ownership to exclude test systems

SplunkCertified Cybersecurity Defense Engineer

Domain 2Objective 2

Incorporate Context into Detections (i.e. Correlation Search). CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 2)

Part of the Detection Engineering domain, which accounts for 40% of the CYBERSECURITY-DEFENSE-ENGINEER exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~12–20 in this domain), expect 2–4 from this objective — we provide 13 practice questions to prepare you well beyond it. (estimate)

13questions here

3free pages

5concepts

40%of the exam

Questions 6–10

6foundation · easy
How can contextual data be incorporated into an alert to make it more actionable for a security analyst?
Select an answer first
7foundation · easy
A correlation search detects anomalous outbound traffic. How can network context be used to set a dynamic threshold?
Select an answer first
8foundation · easy
What is the primary benefit of designing a correlation search that includes contextual data?
Select an answer first
9application · medium
A security team wants to detect anomalous outbound data transfers. They have a lookup that categorizes each internal asset by its normal data-transfer volume (low, medium, high). Which correlation search design would best reduce false positives while still detecting unusual activity?
Select an answer first
10foundation · easy
A correlation search flags every failed login to a domain controller as a potential brute-force attack. How can incorporating asset context reduce false positives?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-DEFENSE-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ENGINEER” is a trademark of its owner, used for identification only.