Fifty questions, two hours, seventy percent. EC-Council attaches no weighting to any of the eight CTIA areas, so the only ordering signal in the syllabus is the shape it is written in: the intelligence cycle, start to finish.
Naming an objective Malware as a Collection Source reclassifies a whole discipline into an intelligence input. Nine unweighted objectives, and why coverage beats a mark budget on this paper.
A domain-by-domain guide to the Splunk SPLK-5002 Detection Engineering exam: data normalisation, correlation-search tuning, risk-based alerting, the detection lifecycle, SOAR automation, and metrics.
