What is the primary purpose of a risk-based modifier in Splunk detection engineering?

To adjust the risk score of a detection based on additional context or conditions

To provide a visual dashboard for risk scores

To replace the need for correlation searches in threat detection

To automatically quarantine endpoints that match a detection

How does a risk score help prioritize detections in Splunk?

It aggregates risk across detections to highlight high-risk entities

It indicates the severity of a single event

It replaces the need for analyst review

It determines the order in which detections are executed

An organization has a detection that flags 'multiple failed logons' and assigns a risk score of 10 to the 'user' risk object. The security team notices that failed logons from a specific 'source_ip' that is a known vulnerability scanner are generating noise. They want to reduce the risk score for events originating from that scanner. What is the best way to apply a risk-based modifier to achieve this?

Change the risk object of the original detection from 'user' to 'source_ip' so the scanner's risk is tracked separately.

Create a new detection that specifically looks for the scanner's 'source_ip' and assigns a negative risk score.

Modify the original detection to add a filter that excludes the scanner's 'source_ip' from the search.

Create a risk-based modifier that matches the 'source_ip' of the scanner and subtracts 10 from the risk score, then apply it to the detection.

In Splunk, what does a risk-based modifier typically act upon?

The raw event data of a detection

The search head's configuration files

The risk score assigned to a risk object

The alert action settings of a detection

How do you apply a risk-based modifier to an existing detection in Splunk?

By creating a new detection that duplicates the original

By editing the detection's search query to include the modifier

By associating the modifier with the detection in the risk-based alerting configuration

By modifying the permissions of the detection

SplunkCertified Cybersecurity Defense Engineer

Domain 2Objective 3

Understand and Create Risk-Based Modifiers and Detections. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 4)

Part of the Detection Engineering domain, which accounts for 40% of the CYBERSECURITY-DEFENSE-ENGINEER exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~12–20 in this domain), expect 2–4 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

6concepts

40%of the exam

Questions 16–20

16foundation · easy
What is the primary purpose of a risk-based modifier in Splunk detection engineering?
Select an answer first
17foundation · easy
How does a risk score help prioritize detections in Splunk?
Select an answer first
18application · medium
An organization has a detection that flags 'multiple failed logons' and assigns a risk score of 10 to the 'user' risk object. The security team notices that failed logons from a specific 'source_ip' that is a known vulnerability scanner are generating noise. They want to reduce the risk score for events originating from that scanner. What is the best way to apply a risk-based modifier to achieve this?
Select an answer first
19foundation · easy
In Splunk, what does a risk-based modifier typically act upon?
Select an answer first
20foundation · easy
How do you apply a risk-based modifier to an existing detection in Splunk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-DEFENSE-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ENGINEER” is a trademark of its owner, used for identification only.