A small security team is responsible for monitoring a multi-cloud environment. They currently manually review alerts from AWS GuardDuty, Azure Sentinel, and Google Chronicle. The team is overwhelmed by the volume of alerts and wants to reduce the time spent on manual triage. Which approach best addresses this challenge?

Hire additional analysts to manually review the alerts.

Increase the severity threshold for all alerts so that only the most critical alerts are generated.

Disable alerts from two of the three cloud providers and focus only on the most critical one.

Implement automated response playbooks that handle low-confidence alerts automatically and only escalate high-confidence alerts to the team.

Why is it important to test automated detection and response mechanisms?

To increase the number of false positives

To ensure they work as expected during real incidents

To eliminate the need for monitoring

What is the core idea behind 'detection as code'?

Automatically generating detection rules from threat intelligence

Managing detection rules as versioned, testable, and deployable artifacts

Using only cloud-native detection services

Writing detection rules in a programming language like Python

How does automated detection improve response times in cloud security?

By eliminating the need for incident response plans

By automatically patching all vulnerabilities

By increasing the number of false positives

By reducing the time between threat occurrence and analyst notification

A small security team is overwhelmed by the volume of low-severity alerts from their cloud environment. They want to reduce manual effort and improve response times for common, well-understood threats. Which approach best achieves this?

Disable all low-severity alerts to focus only on high-severity ones.

Hire more analysts to manually review every alert.

Increase the alert threshold so fewer alerts are generated, reducing the workload.

Implement automated detection rules that trigger playbooks to perform containment actions for known threat patterns, with human review for high-impact actions.

GIAC Cloud Threat Detection

Domain 3Objective 1

Automated Detection and Response GCTD Practice Questions (Page 5)

Part of the Cloud Threat Detection and Response domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 4–7 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

10concepts

Questions 21–25

21application · medium
A small security team is responsible for monitoring a multi-cloud environment. They currently manually review alerts from AWS GuardDuty, Azure Sentinel, and Google Chronicle. The team is overwhelmed by the volume of alerts and wants to reduce the time spent on manual triage. Which approach best addresses this challenge?
Select an answer first
22foundation · easy
Why is it important to test automated detection and response mechanisms?
Select an answer first
23foundation · easy
What is the core idea behind 'detection as code'?
Select an answer first
24foundation · easy
How does automated detection improve response times in cloud security?
Select an answer first
25application · medium
A small security team is overwhelmed by the volume of low-severity alerts from their cloud environment. They want to reduce manual effort and improve response times for common, well-understood threats. Which approach best achieves this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.