Splunk Certified Cybersecurity Defense Architect (SPLK-5003) Feed

Question

An enterprise SOC architect is designing a Splunk Enterprise Security deployment that must ingest 5 TB/day of security data with sub-second notable event creation. Which deployment topology BEST meets these requirements?

Security Capability Selection Placement Configuration

Question · Easy

Question

Which Splunk Enterprise Security index stores risk modifiers contributed by correlation searches in a risk-based alerting design?

Security Data Management

Question · Easy

Question

An architect must define the data residency strategy for a multinational customer with offices in the EU, US, and Singapore. Which Splunk pattern BEST supports GDPR, US compliance, and APAC laws while still enabling SOC-wide search?

Governance Risk And Compliance

Question · Medium

Podcast

Tech Exam Prep Podcast

Listen on Spotify

Podcast

Question

When designing an ES asset and identity framework for a 100,000-employee enterprise, which combination of lookups should be configured to enrich notable events with business context?

Security Data Management

Question · Easy

Question

A new business unit will onboard 800 GB/day of EDR telemetry. Which architectural step is MOST critical BEFORE writing any correlation searches against the new data?

Security Data Management

Question · Easy

Question

Which scaling strategy is MOST appropriate when an ES search head experiences chronic skipped scheduled correlation searches at peak hours despite adequate CPU?

Scaling Cybersecurity Defenses And Devsecops

Question · Medium

Question

An architect is sizing a Splunk indexer tier for security workloads. What is Splunk's published reference indexing throughput per indexer for ES-class workloads on reference hardware?

Security Capability Selection Placement Configuration

Question · Medium

Question

Which Splunk capability BEST enables consistent CIM normalization at the edge before data reaches indexers, especially for cloud-native sources?

Security Data Management

Question · Medium

Question

In a mature RBA architecture, which combination triggers a risk notable from the risk incident rule (RIR)?

Security Data Management

Question · Medium

Question

An architect must integrate Splunk SOAR with Splunk Enterprise Security so that notables automatically open SOAR cases. Which integration mechanism is the canonical choice?

Advanced Automation And Orchestration

Question · Easy

Question

Which Splunk SOAR component allows on-prem-only assets (firewalls, AD, file shares) to be reachable from a cloud SOAR tenant without exposing inbound ports?

Advanced Automation And Orchestration

Question · Medium

Question

Splunk Mission Control unifies which three security capabilities into a single SOC workflow?

Advanced Incident Response And Management

Question · Easy

Question

Which standard is the BEST pick for ingesting machine-readable threat intelligence feeds into Splunk's threat_intel framework over a network protocol?

Advanced Threat Intelligence And Analysis

Question · Easy

Question

An architect is designing an ES detection coverage roadmap. Which framework should drive prioritization of new correlation searches?

Measuring And Improving Security Program Effectiveness

Question · Easy

Question

Which audit-trail strategy BEST satisfies SOX evidence requirements for changes to Splunk ES correlation searches?

Governance Risk And Compliance

Question · Medium

Question

Which Splunk capacity-planning input is MOST important when right-sizing the search head cluster (SHC) for a 24x7 SOC running ES?

Scaling Cybersecurity Defenses And Devsecops

Question · Medium

Question

An architect needs to retain 30 days of hot/warm and 365 days of cold for security data while controlling cost. Which Splunk feature is the canonical lever?

Security Data Management

Question · Medium

Question

Which RBAC pattern is the safest default for a multi-tenant Splunk ES deployment shared by three business units?

Scaling Cybersecurity Defenses And Devsecops

Question · Hard

Question

Which KPI is MOST useful when reporting SOC effectiveness to executive stakeholders quarter-over-quarter?

Measuring And Improving Security Program Effectiveness

Question · Easy

Question

Which Splunk SOAR construct is BEST for reusing a multi-step credential-disable workflow across phishing, brute-force, and impossible-travel playbooks?

Advanced Automation And Orchestration

Question · Easy

Question

An ES detection regularly fires 50+ notables per day for service accounts during patch cycles. Which architectural fix BEST reduces noise without losing signal?

Security Data Management

Question · Hard

Question

Which configuration is REQUIRED to make a CIM data model fast enough for risk-based correlation searches at 10 TB/day scale?

Security Data Management

Question · Easy

Question

An architect is choosing between Splunk Cloud Platform and Splunk Enterprise on-prem for a regulated bank. Which factor MOST clearly favors on-prem?

Governance Risk And Compliance

Question · Medium

Question

Which feature should an architect deploy to detect tampering with the Splunk audit log itself?

Governance Risk And Compliance

Question · Medium

Question

Which approach is the architecturally sound way to ingest 200,000 IoCs/day from a commercial threat-intel provider into ES?

Advanced Threat Intelligence And Analysis

Question · Medium

Question

Which Mission Control feature provides standardized, repeatable response procedures for common incident types?

Advanced Incident Response And Management

Question · Medium

Question

An architect is integrating OpenTelemetry collectors as the standard ingest path for cloud-native services. What is the BEST Splunk-side ingestion endpoint?

Security Data Management

Question · Medium

Question

Which factor MOST drives the recommended replication factor (RF) and search factor (SF) for an ES indexer cluster?

Scaling Cybersecurity Defenses And Devsecops

Question · Hard

Question

Which is the correct order of operations for promoting a new ES correlation search from development into production?

Scaling Cybersecurity Defenses And Devsecops

Question · Easy

Question

An architect must integrate Splunk SOAR with a custom asset-management API that has no published Splunk app. Which approach is the BEST long-term option?

Advanced Automation And Orchestration

Question · Medium

Question

Which configuration BEST controls per-index retention to meet a contractual 7-year hold for SOX-relevant audit data while keeping endpoint telemetry at 90 days?

Governance Risk And Compliance

Question · Easy

Question

An architect must provide search across two on-prem indexer clusters and one Splunk Cloud tenant without copying data. Which capability is REQUIRED?

Scaling Cybersecurity Defenses And Devsecops

Question · Medium

Question

Which Splunk best practice MOST reduces risk-modifier index storage cost without losing fidelity in RBA?

Security Data Management

Question · Hard

Question

An architect is choosing where to do PII redaction for GDPR. Which placement is BEST?

Governance Risk And Compliance

Question · Hard

Question

An architect must decide between deploying SOAR on-prem and Splunk Cloud SOAR. Which factor MOST favors on-prem SOAR?

Advanced Automation And Orchestration

Question · Medium

Question

Which compliance regulation MOST directly drives a 12-month minimum log-retention design baseline for cardholder-data environment logs in Splunk?

Governance Risk And Compliance

Question · Easy

Question

Which architectural pattern produces the MOST reliable view of detection coverage gaps over time?

Measuring And Improving Security Program Effectiveness

Question · Medium

Question

Which Splunk Validated Architecture (SVA) input is REQUIRED before the architect can choose between a single-site and multi-site indexer cluster?

Security Capability Selection Placement Configuration

Question · Easy

Question

An architect is asked to provide a single integrated case-management surface where SOC analysts triage notables, run playbooks, and document evidence for audit. Which Splunk product BEST satisfies this?

Advanced Incident Response And Management

Question · Easy

Question

Which Splunk capability is the canonical target for storing structured indicator-of-compromise (IoC) data referenced by ES correlation searches?

Advanced Threat Intelligence And Analysis

Question · Easy

Question

Which architecture decision is MOST important to keep MTTR low when SOC analysts span three geographic regions?

Advanced Incident Response And Management

Question · Medium

Question

Which architectural pattern for SOAR playbook code review is MOST aligned with DevSecOps?

Scaling Cybersecurity Defenses And Devsecops

Question · Medium

Question

Which metric BEST reflects the value of a high-fidelity RBA design vs. legacy correlation search alerts?

Measuring And Improving Security Program Effectiveness

Question · Medium

Question

Which configuration enables HIPAA-compliant access logging on an index containing ePHI in Splunk?

Governance Risk And Compliance

Question · Medium

Question

Which design pattern provides resiliency against indexer failure for a 24x7 ES SOC while keeping cost reasonable?

Security Capability Selection Placement Configuration

Question · Easy

Question

An architect is designing the threat-intel pipeline. Which step MUST run before indicators are written to the threat_intel KV-store?

Advanced Threat Intelligence And Analysis

Question · Medium

Question

Which architectural choice gives the MOST flexible cost control for a hybrid ingestion strategy at 50 TB/day?

Scaling Cybersecurity Defenses And Devsecops

Question · Medium

Loading more…