Splunk Certified Cybersecurity Defense Analyst
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Splunk Certified Cybersecurity Defense Analyst credential is an intermediate-level certification for security practitioners who use Splunk Enterprise and Splunk Enterprise Security in day-to-day security operations. Splunk positions it for SOC analysts, cybersecurity professionals, and career builders who want to demonstrate knowledge critical to detecting, analyzing, and combating cyber threats. The exam establishes an intermediate standard for users of Splunk Enterprise and Enterprise Security, with no prerequisites, so candidates can sit it without first completing an administrative certification. Content centers on the analyst workflow: using Splunk analytics for continual monitoring, threat hunting, risk-based alerting, and applying industry best practices to prioritize and investigate activity inside a SOC. Expect to reason about data, detections, and analyst judgement rather than platform installation or cluster administration. The exam runs 75 minutes and contains 66 multiple-choice questions, delivered through Splunk's testing partner, Pearson VUE, at $130 USD per attempt. Splunk publishes a test blueprint describing what to expect, and it is the best starting point for planning study. Preparation usually combines Splunk's own security training and hands-on practice in a lab or Boss of the SOC–style exercise, where you can hunt, triage, and document findings the way an analyst would on shift.
What you'll study
About Splunk Certified Cybersecurity Defense Analyst preparation
How long is the exam and how many questions does it have?
The exam is 75 minutes long and consists of 66 multiple-choice questions. That works out to roughly 68 seconds per question, so pacing matters: flag anything that requires deep search-building and return to it after clearing the questions you can answer quickly.
What does the exam cost and where do I take it?
Pricing is $130 USD per exam attempt. Delivery is handled by Splunk's testing partner, Pearson VUE, so you schedule through them and take the exam at a Pearson VUE test center or via online proctoring, depending on what is available in your region.
Are there prerequisites before I can register?
No. Splunk lists no prerequisites for this exam, and it is rated intermediate level. That said, the questions assume familiarity with Splunk search and with Enterprise Security concepts, so candidates without hands-on exposure typically need substantial self-study before attempting it.
What score do I need to pass, and how long is the certification valid?
Splunk's certification page does not publish a passing score or a validity period for this exam. Rather than rely on figures from forums, check the official test blueprint and the Splunk Certification Candidate Handbook, which carry the current scoring and recertification rules.
What happens if I fail - can I retake it?
The retake policy is not stated on the certification overview page. Splunk directs candidates to the Certification Candidate Handbook and the Exam Agreement for the governing rules, including any waiting period between attempts and how each additional attempt is charged. Review those documents before you book a second sitting.
Who is this certification actually designed for?
It targets SOC analysts who want to formalize their position, cybersecurity professionals extending a cyber defense career, and career builders moving into security operations. Splunk describes it as establishing an intermediate-level standard for users of Splunk Enterprise and Enterprise Security who want to be certified as cybersecurity professionals.
What topics should I study, in what order?
Start with SOC and SIEM fundamentals, then risk-based alerting, then threat hunting, then detection and investigation work. Splunk points candidates to the test blueprint for exam expectations, and recommends related training such as Boss of the SOC and the SOC administrator learning path for practical exposure to how incidents appear in Splunk.
What is the most common way candidates underperform?
Usually by over-preparing on platform administration and under-preparing on analyst judgement. The exam rewards knowing how to hunt, triage, and prioritize with risk-based alerting, not how to install or size a deployment. Practicing investigations end to end in a lab, and defending your conclusions, closes that gap fastest.
Does earning this replace the Splunk Enterprise Security Certified Admin?
No, they are separate credentials with different audiences. Splunk presents the Enterprise Security Certified Admin as the path for installing, configuring, and managing an ES deployment, while the Cybersecurity Defense Analyst focuses on using Splunk analytics for monitoring, hunting, and detecting threats as an analyst.