You can see it againUnder pressure people bring back shapes and positions long after the wording has gone.
Picture superiority · Shepard 1967, Standing 1973
SPLUNKSplunk Certified Cybersecurity Defense Analyst
The Splunk Certified Cybersecurity Defense Analyst certification validates your ability to detect, analyze, and combat cyber threats using Splunk Enterprise and Enterprise Security. Designed for SOC analysts and cybersecurity professionals, it demonstrates hands-on skills in threat hunting, risk-based alerting, and continuous monitoring. Earning this credential proves you can help protect businesses and mitigate risk with industry best practices.
Exam formatMultiple choice
Duration75 minutes
DeliveryPearson VUE
Free questions562
Content last reviewed 30 July 2026 · Up to date
The certification
What SPLK-5001 proves, and what it asks of you
What this certification covers, who it is written for, and what the exam itself looks like on the day.
6domains
24objectives
134concepts
$130 USDexam fee
What it is
What this certification is
What it validates, who it is written for, and the experience it assumes.
About this certification
The Splunk Certified Cybersecurity Defense Analyst certification establishes an intermediate-level standard for users of Splunk Enterprise and Enterprise Security who wish to be certified as cybersecurity professionals. It validates the knowledge and skills critical to detecting, analyzing, and combating cyber threats, including the use of cyber defense tools for continual monitoring as a security analyst.
Earning this certification demonstrates your ability to help protect businesses and mitigate risk while managing vulnerabilities and threats using common types of cyber defense systems. It is a career-building credential for SOC analysts and cybersecurity professionals looking to solidify their position and advance as Splunk certified professionals.
Who it’s for
This certification is for SOC analysts and cybersecurity professionals who use Splunk Enterprise and Enterprise Security to detect, analyze, and respond to cyber threats. It is designed for individuals seeking to validate their skills as a starting point for a career as a SOC analyst. Candidates should be comfortable with Splunk analytics, threat hunting, risk-based alerting, and industry best practices for security monitoring and incident response.
Recommended experience
Splunk recommends hands-on experience with Splunk Enterprise and Enterprise Security in a security operations context, including familiarity with threat detection and monitoring workflows. Experience using Splunk Enterprise and Enterprise Security for security monitoring and incident response; Understanding of common cyber defense systems and threat-hunting techniques; Familiarity with risk-based alerting and security analytics
The syllabus
What you’ll learn
Every domain and objective Splunk measures, with the weight they carry on the exam.
The official Splunk exam outline · checked 30 July 2026 · See the source
The Cyber Landscape, Frameworks, and Standards
- Summarize the organization of a typical SOC and the tasks belonging to Analyst, Engineer and Architect roles.
- Recognize common cyber industry controls, standards and frameworks and how Splunk incorporates those frameworks.
- Describe key security concepts surrounding information assurance including confidentiality, integrity and availability and basic risk management.
Threat and Attack Types, Motivations, and Tactics
- Recognize common types of attacks and attack vectors.
- Define common terms including supply chain attack, ransomware, registry, exfiltration, social engineering, DoS, DDoS, bot and botnet, C2, zero trust, account takeover, email compromise, threat actor, APT, adversary.
- Identify the common tiers of Threat Intelligence and how they might be applied to threat analysis.
- Outline the purpose and scope of annotations within Splunk Enterprise Security.
- Define tactics, techniques and procedures and how they are regarded in the industry.
Defenses, Data Sources, and SIEM Best Practices
- Identify common types of cyber defense systems, analysis tools and the most useful data sources for threat analysis.
- Describe SIEM best practices and basic operation concepts of Splunk Enterprise Security, including the interaction between CIM, Data Models and acceleration, Asset and Identity frameworks, and common CIM fields that may be used in investigations.
- Describe how Splunk Security Essentials and Splunk Enterprise Security can be used to assess data sources, including common sourcetypes for on-prem and cloud based deployments and how to find content for a given sourcetype.
Investigation, Event Handling, Correlation, and Risk
- Describe continuous monitoring and the five basic stages of investigation according to Splunk.
- Explain the different types of analyst performance metrics such as MTTR and dwell time.
- Demonstrate ability to recognize common event dispositions and correctly assign them.
- Define terms and aspects of Splunk Enterprise Security and their uses including SPL, Notable Event, Risk Notable, Adaptive Response Action, Risk Object, Contributing Events.
- Identify common built-in dashboards in Enterprise Security and the basic information they contain.
- Understand and explain the essentials of Risk Based Alerting, the Risk framework and creating correlation searches within Enterprise Security.
SPL and Efficient Searching
- Explain common SPL terms and how they can be used in security analysis, including TSTATS, TRANSACTION, FIRST/LAST, REX, EVAL, FOREACH, LOOKUP, and MAKERESULTS.
- Give examples of Splunk best practices for composing efficient searches.
- Identify SPL resources included within ES, Splunk Security Essentials,
Threat Hunting and Remediation
- Identify threat hunting techniques including configuration, modeling (anomalies), indicators, and behavioral analytics.
- Define long tail analysis, outlier detection, and some common steps of hypothesis hunting with Splunk.
- Determine when to use adaptive response actions and configure them as needed.
- Explain the use of SOAR playbooks and list the basic ways they can be triggered from Enterprise Security.
On the day
The exam itself
Everything Splunk publishes about sitting it, and nothing we inferred.
Prerequisites
No mandatory prerequisites — this certification has no required predecessor exam or credential.
Exam codeSPLK-5001
CertificationSplunk Certified Cybersecurity Defense Analyst
Exam formatMultiple choice
Duration75 minutes
DeliveryPearson VUE
LanguagesEnglish
Pricing$130 USD
After you pass
Where this credential goes next
The path Splunk lays out, how the credential is kept, and where to book.
Step-by-step path to Splunk Certified Cybersecurity Defense Analyst
Credential earnedSplunk Certified Cybersecurity Defense Analyst Certification Renewal and maintenance
Splunk certifications must be renewed every three years. You can renew by pursuing additional certifications, completing continuing education courses, or re-taking the certification exam. Stay current with the latest technologies and maintain your certification.
Learn more about renewal requirements Lifecycle status
This certification is currently active and available. Splunk maintains this certification to validate current skills and industry relevance.
Exam status: ActiveMaintained by Splunk
Exam registration
Register for the exam through Pearson VUE, Splunk’s authorized testing partner.
Schedule your examVisit the official Splunk certification page for exam policies and requirements.
View the official pageYour coach
And when you are serious, your coach Pip takes over
Your coach in the app reads what you have answered with the book closed and tells you one thing to do tonight. It will not count an answer you gave with the page open, and it will tell you when you are not ready.
See how the coach worksBefore you book
Questions people ask
How does the Splunk Certified Cybersecurity Defense Analyst certification relate to the Splunk Certified Cybersecurity Defense Engineer or Architect certifications?
The Cybersecurity Defense Analyst certification is an intermediate-level credential focused on detection and analysis. The Engineer and Architect certifications are higher-level credentials that build on this foundation, covering detection engineering and security architecture respectively.
Do I need to earn a lower-level Splunk certification before taking the SPLK-5001 exam?
No. Splunk lists no mandatory prerequisites for this exam. However, hands-on experience with Splunk Enterprise and Enterprise Security is recommended.
Is the SPLK-5001 exam available in languages other than English?
The official exam page lists the exam in English only. Check with Pearson VUE for the most current language availability.
What job roles does the Splunk Certified Cybersecurity Defense Analyst credential map to?
This credential is designed for SOC analysts and cybersecurity professionals who use Splunk for threat detection, monitoring, and incident response.
Can I recertify by passing a different Splunk exam?
Yes. Splunk's recertification policy allows you to renew your certification by pursuing additional certifications, completing continuing education courses, or re-taking the certification exam.
Is there a hands-on or lab component in the SPLK-5001 exam?
The official exam page lists the format as 66 multiple choice questions. There is no mention of a hands-on or lab component.
Information freshness · Content last reviewed on 2026-07-30 Up to date
Practice free questions 562 questions, free, no account needed.
The curriculum
The whole exam, mapped and written
Every domain, every objective, and every concept Splunk measures — each one written out.
6domains
24objectives
134concepts
121free pages
The domains, and what sits inside them
Every objective below is a page you can open and practise now, without an account.
The official Splunk exam outline · checked 30 July 2026 · See the source
1The Cyber Landscape, Frameworks, and Standards76 questions
Summarize the organization of a typical SOC and the tasks belonging to Analyst, Engineer and Architect roles.5 concepts · 6 pagesOpen →Recognize common cyber industry controls, standards and frameworks and how Splunk incorporates those frameworks.4 concepts · 5 pagesOpen →Describe key security concepts surrounding information assurance including confidentiality, integrity and availability and basic risk management.7 concepts · 5 pagesOpen →
2Threat and Attack Types, Motivations, and Tactics122 questions
Recognize common types of attacks and attack vectors.4 concepts · 5 pagesOpen →Define common terms including supply chain attack, ransomware, registry, exfiltration, social engineering, DoS, DDoS, bot and botnet, C2, zero trust, account takeover, email compromise, threat actor, APT, adversary.15 concepts · 10 pagesOpen →Identify the common tiers of Threat Intelligence and how they might be applied to threat analysis.5 concepts · 5 pagesOpen →Outline the purpose and scope of annotations within Splunk Enterprise Security.2 concepts · 3 pagesOpen →Define tactics, techniques and procedures and how they are regarded in the industry.4 concepts · 4 pagesOpen →
3Defenses, Data Sources, and SIEM Best Practices77 questions
Identify common types of cyber defense systems, analysis tools and the most useful data sources for threat analysis.4 concepts · 5 pagesOpen →Describe SIEM best practices and basic operation concepts of Splunk Enterprise Security, including the interaction between CIM, Data Models and acceleration, Asset and Identity frameworks, and common CIM fields that may be used in investigations.6 concepts · 6 pagesOpen →Describe how Splunk Security Essentials and Splunk Enterprise Security can be used to assess data sources, including common sourcetypes for on-prem and cloud based deployments and how to find content for a given sourcetype.7 concepts · 5 pagesOpen →
4Investigation, Event Handling, Correlation, and Risk143 questions
Describe continuous monitoring and the five basic stages of investigation according to Splunk.9 concepts · 7 pagesOpen →Explain the different types of analyst performance metrics such as MTTR and dwell time.4 concepts · 4 pagesOpen →Demonstrate ability to recognize common event dispositions and correctly assign them.3 concepts · 3 pagesOpen →Define terms and aspects of Splunk Enterprise Security and their uses including SPL, Notable Event, Risk Notable, Adaptive Response Action, Risk Object, Contributing Events.7 concepts · 5 pagesOpen →Identify common built-in dashboards in Enterprise Security and the basic information they contain.4 concepts · 6 pagesOpen →Understand and explain the essentials of Risk Based Alerting, the Risk framework and creating correlation searches within Enterprise Security.8 concepts · 6 pagesOpen →
5SPL and Efficient Searching59 questions
Explain common SPL terms and how they can be used in security analysis, including TSTATS, TRANSACTION, FIRST/LAST, REX, EVAL, FOREACH, LOOKUP, and MAKERESULTS.8 concepts · 4 pagesOpen →Give examples of Splunk best practices for composing efficient searches.10 concepts · 6 pagesOpen →Identify SPL resources included within ES, Splunk Security Essentials,3 concepts · 3 pagesOpen →
6Threat Hunting and Remediation85 questions
Identify threat hunting techniques including configuration, modeling (anomalies), indicators, and behavioral analytics.4 concepts · 5 pagesOpen →Define long tail analysis, outlier detection, and some common steps of hypothesis hunting with Splunk.5 concepts · 5 pagesOpen →Determine when to use adaptive response actions and configure them as needed.4 concepts · 4 pagesOpen →Explain the use of SOAR playbooks and list the basic ways they can be triggered from Enterprise Security.2 concepts · 4 pagesOpen →
Not a table of contents
Every line on this map already opens
In front of every objective the practice pages are already there, free and without an account. This is one objective, opened.
Summarize the organization of a typical SOC and the tasks belonging to Analyst, Engineer and Architect roles.6 pagesOpen →
Free in front of it
29 questions on this objective, five to a page. Every range above is a real page, open now, with no account.
Reading the map is not the same as knowing the ground
The curriculum tells you what is on the exam. Proving you know it is a different job — and it is the one the closed-book run does.
Free questions
562 questions. No account, no card.
The whole bank is open. 5 questions to a page, every answer explained, and a discussion thread on each one.
562questions
121pages
24objectives
Freealways
Start anywhereSummarize the organization of a typical SOC and the tasks belonging to Analyst, Engineer and Architect roles. 29 questions · 6 pages
Browse by domain
Every objective, and every page range, is a link — so you can pick up exactly where you left off.
1The Cyber Landscape, Frameworks, and Standards76 questions
2Threat and Attack Types, Motivations, and Tactics122 questions
3Defenses, Data Sources, and SIEM Best Practices77 questions
4Investigation, Event Handling, Correlation, and Risk143 questions
5SPL and Efficient Searching59 questions
6Threat Hunting and Remediation85 questions
What a practice page gives you
1Five to a page
Short enough to finish, long enough to matter.
2Every answer explained
Not only which one is right — why the others are wrong.
3A discussion on each
Ask, answer, and vote. Every question has its own thread.
A question, and the idea behind it
Every question comes from a concept
These are not trivia. Each one is written against a concept in the book, so when you get one wrong there is somewhere to go and find out why.
The visual book
See it once. Carry it into the exam.
The pages shown here come from our AI-900 book — an example of how each concept is written in plain language and, where the idea needs one, drawn as a full page you can take in at a glance.
134concepts
562free questions
Why a picture, and not another paragraph
Three reasons, and each one is a real finding rather than a slogan.
You can see it againThe whole idea at onceWhere it starts, what happens in the middle, what comes out, and the mistake to avoid.
Multimedia principle · MayerThe look-alikes sit togetherThe pairs the exam tests are drawn side by side, so the difference is seen, not told.
Dual coding · PaivioWhat one page is made of
You are never asked to read a poster here — only to see how one is built. After that, every other page is legible at a glance.
1A numbered strip on top
The idea as a sequence, followed with a finger before a word is read.
2Panels for the parts
What it is, how the machine learns it, when it is the right tool.
3The trap, framed
The distinction the exam tests, given its own box instead of buried in prose.
4One line at the bottom
The sentence to carry into the exam room.
Open book, on purpose
Answer it with the picture beside you
This is the part that teaches. The illustration and the written explanation stay where they are while you work, so a scenario stops being a memory test and becomes something you can simply look at.
It teaches · it does not count
A smartphone uses AI to unlock when the owner looks at the camera. Which AI capability is being used?
AImage classification
BFacial recognition
COptical character recognition
DObject detection
Look at the five steps. Detect finds a face, align straightens it, encode turns it into numbers, search compares it with a stored face, and decide answers one question: is this the same person? Classification would only say “a face”. Detection would only draw a box. Neither decides whose.
Then the page shuts, and it starts counting
The same questions come back with the book closed — that run is the one that counts. After it, your coach picks one thing for tonight, sized to the time you have, and brings pages back before you lose them.
Testing effect · Roediger & Karpicke 2006 · spacing effect · Cepeda et al. 2006
Official resources
Straight from Splunk
Where the exam is defined, scheduled and scored.
3official links
134concepts mapped
The source
Splunk’s own pages
We link to them rather than repeat them, so nothing here goes stale behind them.
Checked against the source
Every objective on the official Splunk outline already has questions here
We build from the official skills outline, not from a summary of it — 24 objectives, 134 concepts written under them, and free questions against every one. When Splunk changes the outline, this page changes with it.
24objectives on the outline→134concepts written→562free questions
An official page tells you what will be asked. It cannot tell you what you will get right.
That is the only question worth answering the night before, and no link answers it. You answer it by taking the questions with the book closed, and seeing what comes back.