SPLK-5001 CyberSecurity defense analyst

[cginsberg]

I am taking the SPLK-5001 Cybersecurity Defense analyst exam, where can I find useful and accurate practice exams to prepare? I find that some available online are AI generated, not realistic, too hard or too easy. Any general study tips would be very helpful

[cginsberg]

thank you, I did all the trainings in the curriculum path for this test with the exception of Using Splunk Enterprise Security as that one has a 1500 fee while all others are free!. Is that course absolutely required to be proficient enough to pass this exam? 

[PickleRick]

Well... Let's put it this way - as far as I remember none of the trainings are formally required. It helps - either this training or hands-on experience working with ES (and I mean experience; not just spinning up a lab environment if you by any chance have access to NFR license as a partner or something like that - a real work experience).

[cginsberg]

chicken / egg thing no? how to get real hands on experience as analyst without doing the training. I have the demo installed/ free version and did some of the tutorial ride along activities but not real world stuff, that seems a bit unrealistic. Are you suggesting to hold off on the exam until getting to that level of hands on work?

[PickleRick · Accepted solution]

I'm just telling you that it helps. I admit I got through the exam back when it was in beta phase without much practical experience using ES (with only some at administering it) and before I did my ES trainings. But I have loads of experience with different security-related solutions and loads of experience with the core Splunk so I had a serious advantage here.

You can of course try and see. After all, an exam, should you attempt it without taking the course, is cheaper than thr course isn't it?

It's simply impossible to:

1) Assess your proficiency not knowing you and not having worked with you

2) Give you more precise pointers without violating the NDA.

The certification flowchart lists the recommended trainings. You can check their outlines and decide for yourself whether you feel knowledgeable enough without taking the training to attempt the exam. The trainings are usually useful because typically when you're working with something on your own you might be simply not using some parts of the functionality or even not be aware of it because you've never needed that.

So this certification as well as some certs in the Splunk Core track (up to and including Admin and (Advanced?) Power User) can be attempted at your discretion - without any required trainings.

I don't think anyone can give you more precise info since - as I said - exam contents are covered with NDA. After all you're supposed to have knowledge to answer the question, not learn the answers mindlessly.

[PickleRick]

There is no such thing as "practice exams" meaning real exam questions. Everyone attempting an exam signs an NDA so even if someone does leak information on the exam itself despite this there's no guarantee that the questions are correct, the answers are really as they were on the exam and so on. Not to mention of course legality of such thing.

So the official way to certification is by completing the certification track - https://www.splunk.com/en_us/training/certification-track/splunk-certified-cybersecurity-defense-ana... - there you have a PDF which lists all the recommended courses which should cover the material needed for the exam.

There are of course third-party trainings on this and similar topics but since they are not officially aligned with Splunk there's no guarantee on their contents and adequacy for particular exam.