Splunk Certified Cybersecurity Defense Architect SPLK-5003 Exam Questions

Answer : A

Protecting the main source-code branch provides a mechanism for controlling which modifications are permitted to enter the codebase used by production or nightly build pipelines.

Repository branch protection can enforce mandatory pull-request reviews, restrict direct pushes, require successful automated tests, and prevent unauthorized changes from being merged.

For example, GitHub protected branches can require approval from authorized reviewers before changes are incorporated into the main branch.

Additional controls can require CODEOWNERS approval, prohibit force pushes, enforce successful security checks, and restrict bypass privileges.

These safeguards establish a controlled approval process between code submission and inclusion in the build.

However, simply enabling branch protection without configuring meaningful restrictions does not guarantee that unauthorized changes will be blocked.

Option C provides cryptographic assurance concerning the origin of signed commits but does not independently establish that the proposed changes were reviewed or authorized.

A legitimately signed commit may still contain unauthorized or malicious modifications.

MFA strengthens authentication but does not replace source-code change approval.

SAST and DAST identify classes of application-security weaknesses but do not determine whether a code modification was authorized.

The strongest implementation combines protected branches, mandatory review, signing where appropriate, and automated security validation.

Official reference / study topic: GitHub, About Protected Branches and Commit Signature Verification.

===============

Answer : D

Static Application Security Testing (SAST) examines application source code or other supported code representations to identify potential security vulnerabilities without executing the application.

It is particularly suitable for integration into source-control workflows, pull requests, and Continuous Integration pipelines.

When developers commit code, automated SAST tools can examine newly introduced changes for potentially unsafe programming constructs, insecure API usage, injection vulnerabilities, hardcoded secrets, and other weaknesses supported by the scanner.

For example, static analysis can identify code paths in which untrusted user input is passed into database operations without appropriate validation or parameterization.

Integrating SAST early in the development lifecycle supports shift-left security practices by providing feedback before vulnerable code progresses toward production.

Findings can be incorporated into pull-request reviews and security gates, with enforcement thresholds determined by organizational risk policies.

Dynamic Application Security Testing, option B, operates against a running application and is therefore not the most direct method for analyzing source code during check-in.

A style and development guide establishes coding standards but does not independently perform automated vulnerability scanning.

Code Enforcement Management Software is not the recognized security-testing category needed for this requirement.

SAST should complement software composition analysis, DAST, manual review, and other application-security controls.

Official reference / study topic: OWASP Developer Guide, Static Application Security Testing and CI/CD integration.

===============

Answer : D

Data normalization enables security teams to analyze events from heterogeneous systems using standardized field names, event classifications, and semantic definitions.

Authentication platforms frequently record equivalent activities using different data structures. One provider may identify the account using username, another may use principalName, while a third may use userIdentity.

Without normalization, threat hunters must maintain separate queries for each platform, increasing search complexity and the likelihood of inconsistent analytical results.

Splunk Common Information Model addresses this problem through standardized data models, including the Authentication data model.

The model provides common attributes such as user, src, dest, and action, allowing investigators to examine authentication activity across multiple vendors and environments.

Once relevant events are normalized, analysts can build reusable searches to identify suspicious login failures, unusual access locations, privilege misuse, and authentication activity associated with compromised identities.

Normalization also supports correlation searches, reporting, and accelerated data models where properly configured.

Risk-based alerting prioritizes accumulated security risk but does not standardize event formats.

Adaptive Response Actions execute security operations in response to findings.

Calculated fields can derive individual attributes but do not independently establish a comprehensive common event schema.

Therefore, data normalization directly addresses the architectural problem.

Official reference / study topic: Splunk Common Information Model, Authentication Data Model; certification blueprint Objective 2.6.

===============

Answer : D

Shift-left security moves vulnerability identification and remediation earlier in the software development lifecycle, ideally before vulnerable code is committed to a shared repository.

Integrating security-analysis plugins directly into developers' Integrated Development Environments (IDEs) provides immediate feedback while code is being written.

These tools can analyze supported programming languages for insecure coding patterns, potentially vulnerable functions, unsafe input handling, and other weaknesses.

Identifying security defects before commit reduces the likelihood that vulnerable changes will enter shared development branches or trigger downstream pipeline failures.

For example, an IDE-integrated static analyzer may identify a potential injection vulnerability while a developer is implementing database-access logic.

The developer can investigate and correct the issue before submitting a pull request.

OWASP recognizes early static application security testing as an important shift-left practice because it can reduce remediation effort and prevent defects from progressing into later development stages.

Repository-based secret scanning is valuable, but option A addresses a narrower category of security exposure and generally operates after code has been submitted.

Post-commit IDE analysis does not provide the earliest practical feedback.

DAST evaluates running applications and is not the most direct method for detecting source-code weaknesses during development.

Pre-commit IDE analysis therefore offers the best match.

Official reference / study topic: OWASP Developer Guide, Static Analysis and DevSecOps Guideline; shift-left testing.

===============

Answer : A

A secure paved-road architecture provides development teams with approved, reusable engineering patterns that incorporate security controls into the standard software delivery process.

Option A combines several complementary capabilities necessary for achieving this objective.

Open Policy Agent (OPA) provides policy-as-code enforcement, allowing organizations to evaluate deployment configurations, infrastructure definitions, and application policies against centrally maintained rules.

Standardized CI/CD templates provide consistent build, testing, security validation, and deployment processes across development teams.

Requiring an approved vault service supports secure management of application credentials, API keys, and other sensitive information without embedding secrets directly into source code.

Together, these capabilities make secure implementation patterns easier to adopt and harder to bypass.

Option B includes valuable infrastructure automation and static analysis but lacks the broader policy enforcement and standardized architectural governance described in option A.

Option C relies partly on recommendations and permits inconsistent enforcement.

Option D depends heavily on documentation and manual reviews, limiting scalability and consistency.

An effective paved-road implementation should also incorporate automated compliance checks, clearly defined exception procedures, and ongoing template maintenance.

Official reference / study topic: Open Policy Agent, OPA in CI/CD Pipelines and Policy-as-Code Enforcement.

===============

Answer : D

Hashcat is a password-recovery and password-auditing utility capable of evaluating password strength by attempting to recover plaintext passwords from supported password hashes.

Security teams can use Hashcat during authorized password audits to identify weak, predictable, reused, or otherwise recoverable passwords.

The tool supports numerous hashing algorithms and password-candidate generation techniques, including dictionary-based, rule-based, and mask-based approaches.

For example, an authorized audit may evaluate whether passwords protected by a particular hashing scheme can be recovered using common password patterns or approved test dictionaries.

Successfully recovered passwords indicate credentials requiring remediation and may expose weaknesses in password policies or credential-protection practices.

Hashcat can use supported CPU and GPU resources to accelerate password-auditing workloads.

However, password recovery does not automatically establish that every unrecovered password is strong. Audit effectiveness depends on the hashing algorithm, available resources, candidate selection, and testing constraints.

ntdsutil is primarily a Windows Active Directory administration and maintenance utility.

BloodHound analyzes relationships and potential privilege-escalation paths within supported identity environments.

The option written as Idifde appears to refer to ldifde, a directory-service import and export utility.

Neither provides Hashcat's dedicated password-recovery functionality.

Password auditing must be conducted under explicit authorization, with secure handling of credential material and documented remediation procedures.

Official reference / study topic: Hashcat, Official Password Recovery Documentation and Supported Hashing Capabilities.

===============

Answer : D

A Security Information and Event Management (SIEM) platform primarily aggregates, normalizes, searches, and correlates security telemetry collected from different technologies across an organization's infrastructure.

These data sources may include identity providers, operating systems, cloud platforms, firewalls, endpoint security solutions, application servers, and network monitoring technologies.

By centralizing this information, a SIEM enables security operations teams to identify patterns that might not be apparent when individual data sources are examined independently.

For example, multiple failed authentication attempts followed by privileged account activity and an unusual outbound connection may indicate potential account compromise.

Splunk Enterprise Security provides detection engineering, correlation searches, threat investigation, and risk-based analysis capabilities that support these use cases.

Its Common Information Model helps normalize data from heterogeneous platforms so that searches and detections can operate consistently across different vendors.

Option A describes Static Application Security Testing (SAST). Option B refers to Configuration Management Database (CMDB) functionality.

Option C is more closely associated with Breach and Attack Simulation (BAS), adversary emulation, and security-control validation.

Although a SIEM can consume outputs from these technologies, its primary function remains the analysis and correlation of security events to identify suspicious behavior and support incident investigation.

Official reference / study topic: Splunk Common Information Model and Splunk Enterprise Security Detection and Investigation.

===============