Splunk Enterprise Security Certified Admin FAQs
What is Splunk Enterprise Security Certified Admin exam?
Splunk Enterprise Security Certified Admin manages a Splunk Enterprise Security environment, including ES event processing and normalization, deployment requirements, technology add-ons, settings, risk analysis settings, threat intelligence and protocol intelligence configuration, and customizations. This exam demonstrates a candidate’s ability to install, configure, and manage a Splunk Enterprise Security deployment.
What are Recommended Prerequisite Courses?
Candidates for this exam are recommended to complete the lecture, hands-on labs, and quizzes that are part of the:
Either
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration courses
Or
- Splunk Cloud Administration course and
- Administering Splunk Enterprise Security course
What is the Registration Policy?
Follow the below mentioned process to register for the exam –
- For all candidates attempting their first exam under the new program, please start by filling out this form to connect your Splunk account to your new Pearson VUE account. Candidates must use Latin characters for all form fields.Candidates with foreign scripts on their photo ID will be granted exam access based on standard transliteration guidelines. Please note: this form only needs to be submitted once for account creation.
- Once your accounts are connected (which may take up to 3 business days), you will receive your exam authorizations via email.
- These authorization emails will contain your “Splunk ID” (hint: not your Splunk.com username), which you’ll use to create an account with Pearson VUE. Your Splunk ID will look like PV-12345678.
- You can register for the exam at a Pearson VUE testing facility near you, or in your home or office via online proctor. We strongly encourage all candidates considering the online proctored option to read this overview prior to scheduling their exam appointment.
- For any questions regarding exam delivery, please contact Pearson VUE directly.
What is the Retake Policy?
Candidates who do not pass an exam on their first attempt must wait 7 days to retake the exam. Wait time begins the day after the exam. Please refer to the table below –
Candidates who do not pass an exam on their second attempt must wait 14 days to retake the exam. Wait time begins the day after the attempt.
Subsequent retakes are as follows:
- Fourth attempt 4 weeks or 28 days
- Fifth attempt 8 weeks or 56 days
- Sixth attempt 8 weeks or 56 days
Retakes beyond the 6th attempt will be considered on a case-by-case basis. Splunk reserves the right to deny a retake beyond the 6th attempt
How many questions will be there on the Splunk Enterprise Security Certified Admin exam?
There will be a total of 61 questions in the exam.
Do we have to pass any exam before applying for Splunk Enterprise Security Certified Admin exam?
No, before applying for the Splunk Enterprise Security Certified Admin exam, candidates are not required to pass any exam. The Splunk Enterprise Security (ES) Certified Admin exam is the final step towards completion of the Splunk ES Certified Admin certification.
What knowledge candidates are recommended for the Splunk Enterprise Security Certified Admin exam?
Candidates for this exam are recommended to complete the lecture, hands-on labs, and quizzes that are part of the either Splunk Enterprise System Administration, Splunk Enterprise Data Administration courses or Splunk Cloud Administration course as well as Administering Splunk Enterprise Security course
What is the cost of the Splunk Enterprise Security Certified Admin exam?
The exam will cost you $125 USD with additional taxes.
What is the course structure for the Splunk Enterprise Security Certified Admin exam?
The topics covered in this exam include: • ES Introduction 5% • Monitoring and Investigation 10% • Security Intelligence 5% • Forensics, Glass Tables, and Navigation Control 10% • ES Deployment 10% • Installation and Configuration 15% • Validating ES Data 10% • Custom Add-ons 5% • Tuning Correlation Searches 10% • Creating Correlation Searches 10% • Lookups and Identity Management 5% • Threat Intelligence Framework 5%
What is the total time duration for the Splunk Enterprise Security Certified Admin exam?
Total seat time for the exam is 60 minutes out of which 3 minutes will be given for reviewing the exam agreement and 57 minutes to complete the exam.
What is there in the Administering Splunk Enterprise Security course?
Administering Splunk Enterprise Security course focuses on Administrators who manage a Splunk Enterprise Security environment, including ES event processing and normalization, deployment requirements, technology add-ons, settings, risk analysis settings, threat intelligence and protocol intelligence configuration, and customizations.
Which are the important content areas for the Splunk Enterprise Security Certified Admin exam?
The following content areas are general guidelines for the content to be included on the exam: • Identifying normal ES use cases • Examining deployment requirements for typical ES installs • Knowing how to install ES and gather information for lookups • Knowing the steps to setting up inputs using technology add-ons • Creating custom correlation searches • Configuring ES risk analysis, threat, and protocol intelligence • Fine-tuning ES settings and other customizations
What are the courses recommended for the Splunk Enterprise Security Certified Admin exam?
The course includes: Either • Splunk Enterprise System Administration • Splunk Enterprise Data Administration courses Or • Splunk Cloud Administration course And • Administering Splunk Enterprise Security course
