Splunk Certified Cybersecurity Defense Engineer의 출제 기준은 시험 주관사의 정책에 따라 수시로 조정됩니다. Fast2test은 2026년에도 SPLK-5002 연습문제를 꾸준히 검토하고 갱신하여, 119문항 전체가 최신 시험 기준을 반영하도록 관리하고 있습니다.

Splunk SPLK-5002 시험 개요:

Splunk SPLK-5002 시험 요강 주제:

SPLK-5002 시험, 응시 전 꼭 확인해야 할 질문들

최신 Cybersecurity Defense Analyst SPLK-5002 무료샘플문제

문제 #1

A Splunk administrator needs to integrate a third-party vulnerability management tool to automate remediation workflows. What is the most efficient first step?

A. Set up a manual alerting system for vulnerabilities
B. Use REST APIs to integrate the third-party tool with Splunk SOAR
C. Write a correlation search for each vulnerability type
D. Configure custom dashboards to monitor vulnerabilities

문제 #2

Which type of correlation search reviews the events in the risk index and uses an aggregation of events impacting a single risk object to generate risk notables?

A. Risk Rule
B. Risk Category
C. Risk Incident Notable
D. Risk Incident Rule

문제 #3

When creating a case in Splunk SOAR, which action should be taken to correlate various findings (risk notables) to ensure all are actioned?

A. Search Splunk Enterprise Security for similar or duplicate events based on the risk_object field in a risk notable.
B. Search Splunk Enterprise Security for all related events based on key fields in a notable and select how to process the results to decide which events to merge into the current investigation.
C. Search Splunk Enterprise Security for similar or duplicate events based on the threat_object field in a risk notable.
D. Search Splunk Enterprise Security for all related events based on key fields in a risk notable and select how to process the results to decide which events to merge into the current investigation.

문제 #4

Which syntax is correct to create two new rows on an existing threat intelligence collection?

A. curl -k -u admin:pass https://localhost:8089/services/data/threat_intel/item/email_intel -d item='[{"src_user": "user_new", "subject":"click this"},{"src_user": "user2_new", "subject":"click this"}]' -G -X
B. curl -k -u admin:pass https://localhost:8089/services/data/threat_intel/item/email_intel -d item='[{"src_user": "user_new", "subject":"click this"}]'
C. curl -k -u admin:pass https://localhost:8089/services/data/threat_intel/item/email_intel -d item="[{"src_user": "user_new", "subject":"click this"},{"src_user": "user2_new", "subject":"click this"}]'
D. curl -k -u admin:pass https://localhost:8089/services/data/threat_intel/item/email_intel -d item='[{"src_user": "user_new", "subject":"click this"}]' -G -X

문제 #5

While working with the SOC analysts to review current contextualization processes, a request for automation has been raised by the SOC team. They are asking for a new automation that will check a potentially malicious URL against a remote URL filtering list. Which of the following options will work for them?

A. Adaptive Response Action
B. Neither Adaptive Action or Input Playbook
C. Input Playbook
D. Adaptive Response Action or Input Playbook

질문과 대답: