Splunk Cybersecurity Defense Engineer (SPLK-5002) Certification Sample Questions

01. An SOP for reported-phishing containers requires every notification to the mail team to use fixed wording, filled in with the sender address, the subject line and the container severity. The engineer wants the playbook to build that message before the send-email action block runs.
Which Splunk SOAR block builds the message?
a) A format block with a template filled from those fields
b) A decision block that branches on the container severity
c) A filter block with conditions on the container's datapaths
d) A prompt block that asks an analyst to write the message

02. The SOC reviews each SOP on a fixed annual schedule. The engineer proposes also defining events that trigger a review outside that cycle. Which two events should trigger an out-of-cycle review of an SOP?
(Choose two.)
a) The SOP is moved into the organization's new document template
b) A tool or data source the SOP depends on is replaced
c) A newly hired responder completes training on the SOP
d) A post-incident analysis finds a step of the SOP failed or was skipped

03. Every ransomware case in Splunk SOAR is supposed to follow the same response procedure: containment, eradication and recovery, each with named tasks and an owner. Analysts currently retype the checklist into case notes, and steps get skipped. Which change makes the procedure appear consistently on every ransomware case?
a) Build a separate playbook for each phase, and run the three together when the case opens
b) Add the checklist as a note template, and remind analysts to copy it into each case
c) Define a workbook with those phases, tasks and owners, and apply it to ransomware cases
d) Create a label for each phase, and move the case between labels as work progresses

04. A nightly reconciliation job pulls every open container from the Splunk SOAR REST API to compare against the ticketing system. The job reports far fewer containers than the SOAR console shows. On busy nights some of its requests are also rejected with a rate-limit response, after which the job resends them immediately and more are rejected.
Which two changes should the engineer make?
(Choose two.)
a) Split the pull across many parallel workers that each send their requests at the same time
b) Wait and back off before retrying a request that was rate limited
c) Switch the job from token authentication to a username and password
d) Treat the first response as complete and pick up the rest on the next night
e) Follow the response's paging information and request each page until none remain

05. Leadership wants a monthly report of blocked outbound firewall connections per business unit, trended over the last 13 months. Raw firewall events are retained for 90 days, business unit is resolved at search time from an asset lookup that is re-imported every month, and audit requires that a month's published figure comes out identical whenever the report is regenerated.
Which design meets these requirements?
a) Schedule the report each month with a fixed 13-month time range and deliver it to leadership as a PDF
b) Schedule a daily search that writes blocked-connection counts by src to a summary index, and apply the business-unit lookup when the report runs
c) Accelerate the Network_Traffic data model and run tstats with the asset lookup applied when the report runs
d) Schedule a daily search that writes blocked-connection counts by business unit to a summary index, and report from it

06. A company runs Splunk SOAR as a cloud service. Its playbooks must disable accounts in an on-premises directory and push block rules to an on-premises firewall, and the security policy forbids any inbound connection from the internet into the data center. How should the engineer give the playbooks that reach?
a) Allow inbound connections from the SOAR service's address range to the two systems
b) Install the directory and firewall apps on an on-premises heavy forwarder
c) Run both steps as adaptive response actions from the Enterprise Security search head
d) Deploy the automation broker on-premises, and assign it to those two assets

07. Responders escalate nearly every finding from a new detection for suspicious service creation to the second tier, although most turn out to be software deployments. The detection's documentation contains its purpose, its SPL and its data dependencies. Which addition to the documentation most directly reduces these escalations?
a) A revision history recording each change made to the detection's search logic
b) A list of the ATT&CK techniques and tactics the detection maps to
c) Response guidance listing triage steps and the benign causes to rule out
d) The name of the engineer who owns the detection and its review schedule

08. An engineer is dividing a new insider-risk use case between Splunk Enterprise Security and Splunk SOAR. It needs a detection over cloud storage audit logs, a score that rises with each related signal on the user, a coordinated response that suspends the user's sessions and opens an HR ticket, and a tracked investigation with tasks for legal and HR.
Which two parts belong in Splunk SOAR?
(Choose two.)
a) The tracked investigation with tasks for legal and HR
b) The coordinated session suspension and HR ticket across other tools
c) The detection logic that searches the cloud storage audit logs
d) The asset and identity context that ES applies to the finding at search time
e) The score that accumulates with each related signal on the user

09. Containers for a network-flow detection often hold dozens of artifacts that repeat the same few destination IPs. The playbook's reputation action takes artifact:*.cef.destinationAddress as its input, and the action log shows the same IP looked up many times per container, exhausting the app's query allowance.
What should the engineer change?
a) Run the reputation action once per artifact in a child playbook
b) Ask the intelligence provider to raise the app's query allowance
c) Point the action at just the first artifact in each container
d) De-duplicate the IPs before the reputation action

10. A Splunk SOAR container created from an EDR finding turns out to be one part of a wider intrusion. The response will take several days, involve the endpoint, identity and network teams, and needs a tracked set of tasks for each stage. What should the engineer do with the container?
a) Promote it to a case
b) Raise its severity to high
c) Add an incident label to it
d) Assign it to the lead responder