Splunk Certified Cybersecurity Defense Architect (SPLK-5003)

Justin’s company is interested in pursuing ISO 27001 certification.

What do they need to have in order to meet the requirements?

A security architect is working with their cloud architect peer to enable additional controls in the non-production cloud environment. During testing, it is shown that the implementation of four of these controls will have a significant cost associated with them.

Which of the following actions needs to be done before presenting their findings to the CISO?

The SOC team has received an alert for suspicious activity on a device assigned to a finance team member. The alert indicates that an unusual executable file was launched and several outbound connections were attempted to an external IP address.

Which of the following is considered a “high-signal” data source due to its visibility into devices and ability to detect suspicious activity?

Where should high value, low volume data be stored for searching (

A security architect is tasked with implementing new security controls in a cloud environment. To minimize operational risk, the architect decides to use a phase-based rollout strategy.

The approach involves the following steps:

Deploy the controls in “monitoring-only” mode on a canary system to observe for any unexpected behavior.

Expand the monitoring deployment to a small subset of production systems.

After validating the results and ensuring minimal impact, gradually enable the controls in blocking/enforcement mode, first on the canary, then the subset, and finally on all systems.

Which of the following best describes the main advantage of this phased, monitoring-first deployment strategy?

AJ has been tasked with designing controls for a new low latency, highly resilient application. The business requires no downtime in the event of a device failure or during maintenance.

Which of the following deployment options will meet these needs?

To measure if the SOC is improving its time to respond, they compute the difference between the event time and in progress time as the response time in minutes.

What type of trend would indicate an improvement?

A new system is being built to track the SBOMs for all applications that are used in the company.

What are the primary items this system is tracking?

Alice helps design the vulnerability management program for a large corporation. The corporation strives to use ITIL best practices for IT and cybersecurity operations.

Low severity vulnerabilities are most commonly remediated using what type of ITIL change?

A SOC engineer has configured a data feed of firewall logs, however the log feed only contains the basic informational fields of timestamp, src_ip, src_port, dst_ip, dst_port, action, and protocol.

Which of the following reflects the best practice for an ideal enrichment strategy?

An organization has decided to adopt a cloud first strategy and move away from on-premises data centers.

What is the recommended underlying storage option to address long term storage needs and meet compliance requirements?

Kevin is a security architect at a publicly traded company.

Why does the business care about a Security Operations Center (SOC)’s metrics for Mean Time to Detect (MTTD)?

Clara is responsible for how her organization’s SIEM ingests and stores event data. The newest version of the SIEM now includes APIs for managing the data ingestion pipelines. Clara wants to evaluate methods to programmatically manage those pipelines using her company’s version control and continuous integration systems.

What benefits would this provide to the organization? (Choose all that apply.)

Ahmed was recently hired as a security architect. He wants to measure how well his new organization is covering threat actor tactics like establishing persistence and escalating privileges.

What step should Ahmed take first?

Sebastian is an incident responder encountering friction when coordinating and communicating with business units outside of his organization on large-scale incidents.

What should he ensure is in place first to enable more seamless incident communications in the future?

Which categories of SOAR playbooks are commonly used within a security operations center? (Choose all that apply.)

During a SOC process and workflow review, the SOC manager observes that the analysts are spending a great deal of time jumping between the EDR, remote access, and IAM consoles to contextualize a finding.

Which of the following will reduce the time to resolution with these issues in mind?

Which of the following are standard features of a Threat Intelligence Platform (TIP)? (Choose all that apply.)

Which of the following is the first step in developing an effective integration strategy for diverse security data sources in a security operations center (SOC)?

What is a Software Bill of Materials (SBOM)?

Analyze the output in the screenshot below.

What is the first step that should be taken to harden this host?

Which of the following best describes how data science, machine learning, behavioral analysis, and AI improve threat detection compared to traditional detection approaches?

The growing rate of cyber attacks has led many countries to adopt laws and regulations pertaining to the collection, handling, and security of their citizens’ private information regardless of where it is stored.

Which of the following terms best describes these laws?

Which of the following explains the benefits of modern cybersecurity defense data architectures using technologies such as data fabric, data lakes, message bus, and federated search?