Splunk Enterprise Security • SPLK-5001 • Intermediate C E R T I F I C A T I O N G U I D E SPLK-5001 Certification Guide: Splunk Certified Cybersecurity Defense Analyst Syllabus, sample questions and a study plan for the Splunk Cybersecurity Defense Analyst exam All six exam domains with Splunk’s own percentage weightings and every published objective, the exam fact sheet, what the October 2026 move of registration to Cisco means for you, how the three-year recertification cycle works, a five-step route from first search to exam day, and ten real sample questions with a full answer key. 66 QUESTIONS 75 MINUTES 700/1000 PASSING SCORE $130 EXAM FEE 6 EXAM DOMAINS Prepared by CertFun • www.certfun.com www.certfun.com SPLK-5001 Splunk Certified Cybersecurity Defense Analyst 1 CERTIFICATION GUIDE Contents Click any line to jump straight to that section. The same eight entries appear in your PDF reader’s bookmark pane. SECTION 01 Exam Overview 2 SECTION 02 What Changed in October 2026 3 SECTION 03 What This Exam Actually Tests 3 SECTION 04 The Six Exam Domains by Weight 4 SECTION 05 What the Credential Is Worth 6 SECTION 06 Getting Certified, Step by Step 7 SECTION 07 SPLK-5001 Sample Questions 7 SECTION 08 Where to Go Next 10 www.certfun.com SPLK-5001 Splunk Certified Cybersecurity Defense Analyst 2 SECTION 01 Exam Overview The SPLK-5001 Splunk Certified Cybersecurity Defense Analyst exam is Splunk’s security-analyst credential: the exam that says you can sit at an Enterprise Security console and work a notable from first alert to disposition. It is 66 multiple-choice questions in 75 minutes, delivered proctored through Pearson VUE. The facts below come from CertFun’s SPLK-5001 exam syllabus and from Splunk’s own published test blueprint and certification track page; where the three overlap they agree line for line. Certification Splunk Certified Cybersecurity Defense Analyst Exam code SPLK-5001 Level Intermediate Number of questions 66 multiple choice Exam duration 75 minutes, including 3 minutes to review the exam agreement Passing score 700 / 1000 (CertFun syllabus; Splunk does not publish a cut score) Exam fee USD 130 per attempt Prerequisite None - Power User level knowledge of Splunk Enterprise is recommended Exam domains 6, weighted 10% or 20% each Delivery Proctored, through Pearson VUE; registration through Cisco from 20 October 2026 Validity 3 years from the date of passing, with a 90-day grace period Three lines in that table deserve a second look. The 75 minutes is footnoted on the blueprint as “total exam time includes 3 minutes to review the exam agreement,” so the working budget is 72 minutes for 66 questions - a little over a minute each, and most of the questions are scenarios rather than one-line recall. The passing score appears only on CertFun’s syllabus page; Splunk’s own page and blueprint give the question count, time and fee but no cut score, so treat 700 of 1000 as the published convention rather than a Splunk statement. And the prerequisite line is genuinely “none”: the blueprint says there are no prerequisite exams, but recommends “Power User Level Knowledge of Splunk Enterprise,” and the SplunkTrust member in the community thread linked at the end of this guide says the same. Splunk does not put a version number on this blueprint, so there is no “old syllabus versus new” question to settle, but it does reserve the right to change the guidelines “at any time without notice.” Re-read the official certification track page the week you book. www.certfun.com SPLK-5001 Splunk Certified Cybersecurity Defense Analyst 3 SECTION 02 What Changed in October 2026 The exam content has not moved, but the way you book it has. Splunk is now a Cisco company, and on 20 October 2026 Splunk certification registration, exam history and support moved into Cisco’s certification systems. The official SPLK-5001 page and the Pearson VUE Splunk page both carry the notice, and Splunk’s Upcoming Splunk Certification Changes FAQ spells out what it means in practice: • From 20 October 2026 you register for Splunk exams through Cisco, not the old Splunk portal. A Splunk ID is no longer needed. • Existing Splunk certification accounts and exam history were migrated to Cisco’s tracking system; log in with the email tied to your certifications and open a case with the Learn with Cisco Help Center if anything is missing. • An exam already booked through Splunk is honoured through 1 March 2027. • Active Splunk exam vouchers still work for Splunk exams delivered through Cisco. • Badges still come from Credly, now on the Cisco Credly page; certifications are visible in Certmetrics or Credly. • The old splunk_certification@cisco.com mailbox is no longer monitored - support is the Learn with Cisco Help Center. Nothing in the fact sheet changes with the move: still 66 questions, 75 minutes, USD 130, Pearson VUE delivery. Budget ten extra minutes the first time you book to get the Cisco account sorted. SECTION 03 What This Exam Actually Tests Splunk’s own framing is that the exam “establishes an intermediate-level standard for users of Splunk Enterprise and Enterprise Security who wish to be certified as cybersecurity professionals,” demonstrating “knowledge critical to detecting, analyzing and combating cyber threats.” Read the six domains together and the paper splits roughly in half. The first two domains - 30% between them - are security literacy : how a SOC is organised, the frameworks it reports against, the attack types and threat-intelligence tiers an analyst must name on sight. The other four domains - 70% - are Splunk Enterprise Security at the console : which data sources matter and how CIM, data models and the asset and identity frameworks normalise them (domain 3), how a notable is raised, triaged and dispositioned and how Risk-Based Alerting accumulates risk (domain 4), the SPL an analyst actually types - tstats, transaction, rex, eval, foreach, lookup, makeresults - and how to make it efficient (domain 5), and hunting techniques, adaptive response actions and SOAR playbooks (domain 6). Four domains tie at 20%, so there is no single topic to over-prepare the way there is on the Power User paper. What recurs instead is one habit of mind : the questions describe what an analyst sees - a metric that moved, a field with mixed values, a search that rarely fires - and ask for the accurate reading. Knowing how Enterprise Security produces what is on the screen matters more than memorising menus. www.certfun.com SPLK-5001 Splunk Certified Cybersecurity Defense Analyst 4 Who Splunk wrote this exam for Career builders who want a Splunk credential that reads as security, not just search. SOC analysts already working notables in Splunk Enterprise Security. Cybersecurity professionals adding Splunk to a broader cyber-defence background. Anyone heading for Enterprise Security Certified Admin or the Defense Engineer exam. This is an analyst’s exam, not an administrator’s . Installing and configuring Enterprise Security is the Enterprise Security Certified Admin paper, SPLK-3001, which sits beside this one on the CertFun Splunk vendor page. SECTION 04 The Six Exam Domains by Weight Splunk publishes the weightings, so the chart below is the real thing rather than a proxy. Two domains are worth 10% and four are worth 20%. On a 66-question paper that is roughly six or seven questions for each 10% domain and thirteen for each 20% domain - our arithmetic, not Splunk’s, but a fair guide to where the marks sit. 1 Cyber Landscape and Frameworks 10% 2 Threats, Attacks and Tactics 20% 3 Defenses, Data Sources, SIEM 20% 4 Investigation, Correlation, Risk 20% 5 SPL and Efficient Searching 20% 6 Threat Hunting and Remediation 10% Official percentage weightings, from Splunk’s Certified Cybersecurity Defense Analyst test blueprint. Every objective follows in Splunk’s own wording, cross-checked against the CertFun syllabus page. Read it as a checklist: if you cannot explain or demonstrate the item named in a line, it is a study item. 1.0 The Cyber Landscape, Frameworks, and Standards — 10% • Summarize the organization of a typical SOC and the tasks belonging to Analyst, Engineer and Architect roles. • Recognize common cyber industry controls, standards and frameworks and how Splunk incorporates those frameworks. • Describe key security concepts surrounding information assurance including confidentiality, integrity and availability and basic risk management. www.certfun.com SPLK-5001 Splunk Certified Cybersecurity Defense Analyst 5 2.0 Threat and Attack Types, Motivations, and Tactics — 20% • Recognize common types of attacks and attack vectors. • Define common terms including supply chain attack, ransomware, registry, exfiltration, social engineering, DoS, DDoS, bot and botnet, C2, zero trust, account takeover, email compromise, threat actor, APT, adversary. • Identify the common tiers of Threat Intelligence and how they might be applied to threat analysis. • Outline the purpose and scope of annotations within Splunk Enterprise Security. • Define tactics, techniques and procedures and how they are regarded in the industry. 3.0 Defenses, Data Sources, and SIEM Best Practices — 20% • Identify common types of cyber defense systems, analysis tools and the most useful data sources for threat analysis. • Describe SIEM best practices and basic operation concepts of Splunk Enterprise Security, including the interaction between CIM, Data Models and acceleration, Asset and Identity frameworks, and common CIM fields that may be used in investigations. • Describe how Splunk Security Essentials and Splunk Enterprise Security can be used to assess data sources, including common sourcetypes for on-prem and cloud based deployments and how to find content for a given sourcetype. 4.0 Investigation, Event Handling, Correlation, and Risk — 20% • Describe continuous monitoring and the five basic stages of investigation according to Splunk. • Explain the different types of analyst performance metrics such as MTTR and dwell time. • Demonstrate ability to recognize common event dispositions and correctly assign them. • Define terms and aspects of Splunk Enterprise Security and their uses including SPL, Notable Event, Risk Notable, Adaptive Response Action, Risk Object, Contributing Events. • Identify common built-in dashboards in Enterprise Security and the basic information they contain. • Understand and explain the essentials of Risk Based Alerting, the Risk framework and creating correlation searches within Enterprise Security. 5.0 SPL and Efficient Searching — 20% • Explain common SPL terms and how they can be used in security analysis, including TSTATS, TRANSACTION, FIRST/LAST, REX, EVAL, FOREACH, LOOKUP, and MAKERESULTS. • Give examples of Splunk best practices for composing efficient searches. • Identify SPL resources included within ES, Splunk Security Essentials, and Splunk Lantern. www.certfun.com SPLK-5001 Splunk Certified Cybersecurity Defense Analyst 6 6.0 Threat Hunting and Remediation — 10% • Identify threat hunting techniques including configuration, modeling (anomalies), indicators, and behavioral analytics. • Define long tail analysis, outlier detection, and some common steps of hypothesis hunting with Splunk. • Determine when to use adaptive response actions and configure them as needed. • Explain the use of SOAR playbooks and list the basic ways they can be triggered from Enterprise Security. A navy edge marks the four 20% domains. The 24 objectives above are the complete published list; the blueprint adds that “other related topics may also appear on any specific delivery of the exam.” SECTION 05 What the Credential Is Worth This is the certificate that lets a Splunk user apply for security-analyst roles rather than reporting ones. ZipRecruiter’s Cyber Security Analyst salary page puts the average US pay for a Cyber Security Analyst at $99,400 a year as of 22 October 2026, with the middle half of postings between $79,500 and $115,500 and the 90th percentile at $137,500. ZipRecruiter adds that the range varies greatly, which it reads as room to move up on skill, location and experience. Treat those as figures for the job title, not for the certificate itself. The structural argument is simpler than any salary table. Enterprise Security is one of the most widely deployed SIEM platforms, and the skills this exam certifies - CIM normalisation, notable triage, Risk-Based Alerting, efficient SPL, hypothesis hunting - are the daily work of a SOC. Splunk’s own page names three audiences for it: career builders, SOC analysts and cybersecurity professionals. Why this exam, specifically No prerequisite exam - Power User knowledge is recommended, not required. Splunk’s own security-analyst credential, built around Enterprise Security. Leads on to Enterprise Security Certified Admin and the Defense Engineer exam. Valid for three years, with a 90-day grace period after the cycle ends. On that last point, Splunk’s recertification policy is worth reading once. Every Splunk certification runs on a three-year cycle from the date the highest-level certification was earned, with a 90-day grace period after it. You renew either by passing a higher-level exam, which also renews everything below it, or by retaking the same exam inside the final year of the window. www.certfun.com SPLK-5001 Splunk Certified Cybersecurity Defense Analyst 7 SECTION 06 Getting Certified, Step by Step 1 Get Power User-level Splunk under your fingers Searching, fields, stats, lookups and data models on a running instance. 2 Work the learning-path courses The Cybersecurity Landscape through Using Splunk Enterprise Security - eleven on the blueprint. 3 Live in Enterprise Security Incident Review, Risk Analysis, the asset and identity framework, correlation searches. 4 Drill the analyst SPL and the frameworks tstats, transaction, rex, eval, foreach, lookup; the frameworks Splunk maps to. 5 Book the proctored exam through Cisco Sixty-six questions, 75 minutes, USD 130, delivered by Pearson VUE. Step three is the one people skip and regret. The community thread linked at the end of this guide is a candidate who had done every free course on the path and asked whether the paid Using Splunk Enterprise Security class was essential; the SplunkTrust answer was that no training is formally required, but either that course or real hands-on Enterprise Security work is what carries you. The eleven courses Splunk lists on the blueprint - The Cybersecurity Landscape, Understanding Threats and Attacks, Security Operations and the Defense Analyst, Intro to Splunk, Data and Tools for Defense Analysts, Introduction to Enterprise Security, Search under the hood, The Art of investigation, SOC Essentials: Investigating with Splunk ES, SOC Essentials: Introduction to Threat Hunting and Using Splunk Enterprise Security - are collected on its certification learning paths page. For the last stretch, CertFun’s SPLK-5001 practice exam mirrors the real format and timing so you find the gaps before the exam does. SECTION 07 SPLK-5001 Sample Questions These ten come from CertFun’s SPLK-5001 sample questions page, shown here in shuffled order. All ten are single-answer. Notice the shape: every one describes what an analyst sees - a metric that improved for the wrong reason, a field holding two kinds of value, a correlation search that rarely fires - and asks for the accurate reading, which is exactly how the paper reads. www.certfun.com SPLK-5001 Splunk Certified Cybersecurity Defense Analyst 8 Q1. Reading the configuration of a correlation search, an analyst finds that creating the notable event is itself listed among the search’s adaptive response actions, alongside an action that sends an email. What does that tell the analyst about how correlation searches produce notables? a) The email action creates the notable, and the search would raise nothing without it b) Notable creation is an adaptive response action that only an analyst can trigger from the notable c) The listing is a display quirk, and notable creation is a fixed behavior of every correlation search that cannot be removed d) A notable is one of the response actions a search may take on a match, configured like any other Q2. An analyst has a list of four thousand known-bad IP addresses from an intelligence report and wants to find any connection event to any of them over the last month. A first attempt writes every address into the base search joined by OR. The list will be refreshed every week and reused in several searches. What is the better approach? a) Keep the OR chain but move it after the base search into a where clause b) Split the search into forty runs of one hundred addresses each and combine the results by hand c) Load the addresses into a lookup table and match events against it with lookup d) Search for the addresses’ network ranges instead, using a wildcard on the first two octets Q3. Sign-in events from the VPN carry the account as an email address, while events from the domain controllers carry it as a short account name. On notable events for either, the asset and identity framework shows the same person’s name, department and manager. What makes that possible? a) The VPN add-on rewrites the email address into the short account name before indexing b) The framework matches on the person’s name field, which both sources populate c) An analyst has manually linked the two accounts on a previous notable d) The identity record lists several identifiers for each person Q4. Three months after a notable event was raised, an analyst reopens it during a related investigation. The notable is still on record with all its fields, but opening the events behind it returns nothing. What is the most likely reason? a) The source events aged out of their index, while the notable was kept longer b) The correlation search that raised it has since been disabled c) The data model the search read has been rebuilt, which removed the events d) Closing the notable deleted the events it referenced www.certfun.com SPLK-5001 Splunk Certified Cybersecurity Defense Analyst 9 Q5. On premises, the SOC reads the Windows Security event log to see administrator sign-ins to servers. The organization is now moving its administration to a cloud tenant, where administrators sign in through the cloud identity provider and manage resources through the provider’s console. Which cloud source is the equivalent for seeing those administrative sign-ins? a) The operating system logs of the cloud virtual machines, which record sign-ins as they did on premises b) The virtual network flow logs, which record the connections administrators make to cloud resources c) The cloud provider’s billing records, which show which administrator created each resource d) The cloud identity provider’s sign-in log, which records each authentication to the tenant Q6. Searching the Network Traffic data model, an analyst sees that on some events src holds an IP address while on others it holds a hostname. A colleague says this means the normalization for one of the sources is broken. What is the accurate reading? a) The mixed values mean the two sources cannot be searched together and must be handled by separate correlation searches b) The colleague is right: src must always hold an IP address, so events carrying a hostname come from a source that is not normalized c) src is the source in whatever form the source knows it, and separate address and hostname fields exist d) The hostname values were added by the asset lookup, replacing the original address Q7. A SOC’s overall mean time to respond improved over the quarter. Reviewing the individual events, the manager finds that response to the critical-urgency notables actually got slower, while a large volume of low-urgency notables was handled very quickly. What does this show about how the metric should be reported? a) Broken down by urgency, since a mass of easy events can pull the overall figure down b) It should be reported only for critical notables, since low-urgency events do not matter c) It should be replaced by dwell time, which is not affected by the mix of events d) The overall figure is correct, so the slower critical response is not a concern Q8. While developing a search an analyst runs index=security | head 100 | table _time, user, action before running it over the full time range. Why is that a sensible development practice? a) Duplicate events are removed before table renders them, so each user appears on a single row while the search is being checked b) Only the first hundred results are processed, so the fields and the layout can be checked without loading the whole index c) table cannot render an unbounded result set, so a limit must precede it in every search that uses it d) Dispatching to fewer indexers leaves the rest of the cluster free, so other analysts’ searches are not delayed while this one is being drafted www.certfun.com SPLK-5001 Splunk Certified Cybersecurity Defense Analyst 10 Q9. A correlation search runs every five minutes over the preceding five minutes of a cloud provider’s audit source. The source is onboarded and complete, and searching it by hand always finds the events the search should match, yet the search rarely raises anything. Comparing timestamps, the analyst finds that each event was indexed about fifteen minutes after its own timestamp. The provider’s clock has been checked and is accurate. What is happening? a) The search’s throttling suppresses the notables because the same events are matched on every run b) The audit source is not normalized to the model the search reads, so the fields the search filters on are empty c) The events arrive about fifteen minutes late, so the window covering their timestamps has already been searched d) The provider’s clock is fifteen minutes ahead, so the events are timestamped in the future and fall outside every search window Q10. Every morning, the entities at the top of the Risk Analysis dashboard are the organization’s domain controllers and payment servers. The organization’s risk framework is configured to weight risk contributions by asset priority. Investigating each day, analysts find the contributing events are routine administrative activity. What best explains why those hosts keep rising to the top? a) The hosts are compromised, since risk only accumulates on entities involved in malicious activity b) High asset priority can raise the risk each event contributes, so routine activity on critical hosts accumulates quickly c) The dashboard sorts entities by name, and those hosts happen to sort first d) Risk from all hosts in the estate is attributed to the domain controllers because they authenticate every sign-in Answer key Q1 Q2 Q3 Q4 Q5 Q6 Q7 Q8 Q9 Q10 d c d a d c a b c b SECTION 08 Where to Go Next Re-read the official SPLK-5001 exam page before you book - Splunk states outright that the blueprint guidelines may change without notice, and the booking route itself changed in October 2026. When the courseware and your own instance disagree, the Splunk Enterprise Security community is where candidates and SplunkTrust members compare notes; the thread linked here is a January 2025 exchange about exactly this exam, from which courses matter to whether hands-on Enterprise Security time can be skipped. www.certfun.com SPLK-5001 Splunk Certified Cybersecurity Defense Analyst 11 Quick reference Official certification track - splunk.com/en_us/training Official test blueprint PDF - splunk.com/en_us/pdfs/training Booking (via Cisco) and proctoring - pearsonvue.com/us/en/splunk Syllabus, sample questions and practice test - certfun.com/splunk Before you book — the guide in one card Questions 66 multiple choice Duration 75 minutes (72 working) Passing score 700 / 1000 (CertFun) Exam fee USD 130 Exam domains 6, officially weighted Heaviest domains Four tied at 20% Level Intermediate Prerequisite None (Power User knowledge advised) Validity 3 years, 90-day grace Delivery Pearson VUE, booked via Cisco Leads to Enterprise Security Certified Admin Also leads to Cybersecurity Defense Engineer Good luck - and as you revise, keep asking one question of everything on the Enterprise Security screen: how did it get there? A notable came from a correlation search, a risk score from weighted contributing events, a name on a notable from an identity record, an empty result from a window that had already been searched. Once you can trace each one back, most of the sixty-six answer themselves.