A security team manages detection rules as code in a Git repository. They want to ensure that every rule change is tested against a representative dataset before being deployed to production. The team has a CI/CD pipeline but is concerned about the time it takes to run the tests. Which approach balances testing thoroughness with pipeline speed?

Run a full regression test against the entire historical dataset on every change, and block the deployment if any test fails.

Run a small, curated set of test cases that cover the rule's intended behavior on every change, and run a full regression test only on merges to the main branch.

Deploy all changes directly to production and monitor the alert volume for a week to identify any issues.

Skip automated testing and rely on manual code review by senior analysts before deployment.

A SOC manager wants to measure the effectiveness of their automated response playbooks. They have data on the number of alerts, the number of playbook executions, and the time from alert to resolution. Which metric is most useful for evaluating the efficiency of the automated response?

The percentage of alerts that were resolved without human intervention.

The total number of playbook executions in the last month.

The number of distinct playbooks that were executed.

The average time from alert creation to playbook execution.

A security team uses a CI/CD pipeline to deploy detection rules to production. They want to ensure that a rule does not cause a significant increase in false positives before it is fully deployed. Which strategy is most effective?

Use a canary deployment that enables the rule for a small percentage of users and gradually increases.

Deploy the rule directly to production and monitor for issues.

Deploy the rule in a 'test' mode that logs alerts without triggering responses, and compare the alert volume against a baseline for a week.

Run the rule against historical data in a separate environment and assume it will behave the same in production.

What is the purpose of automated response orchestration in cloud security?

To replace all human decision-making in incident response

To automatically trigger predefined actions based on detection alerts

To manually execute response actions

GIAC Cloud Threat Detection

Domain 3Objective 1

Automated Detection and Response GCTD Practice Questions (Page 8)

Part of the Cloud Threat Detection and Response domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 4–7 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

10concepts

Questions 36–40

36foundation · easy
Which cloud-native service is a SIEM (Security Information and Event Management) solution offered by Microsoft Azure?
Select an answer first
37expert · hard
A security team manages detection rules as code in a Git repository. They want to ensure that every rule change is tested against a representative dataset before being deployed to production. The team has a CI/CD pipeline but is concerned about the time it takes to run the tests. Which approach balances testing thoroughness with pipeline speed?
Select an answer first
38application · medium
A SOC manager wants to measure the effectiveness of their automated response playbooks. They have data on the number of alerts, the number of playbook executions, and the time from alert to resolution. Which metric is most useful for evaluating the efficiency of the automated response?
Select an answer first
39expert · hard
A security team uses a CI/CD pipeline to deploy detection rules to production. They want to ensure that a rule does not cause a significant increase in false positives before it is fully deployed. Which strategy is most effective?
Select an answer first
40foundation · easy
What is the purpose of automated response orchestration in cloud security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Automated Detection and Response GCTD Practice Questions (Page 8)

Questions 36–40

Which cloud-native service is a SIEM (Security Information and Event Management) solution offered by Microsoft Azure?

A SOC manager wants to measure the effectiveness of their automated response playbooks. They have data on the number of alerts, the number of playbook executions, and the time from alert to resolution. Which metric is most useful for evaluating the efficiency of the automated response?

A security team uses a CI/CD pipeline to deploy detection rules to production. They want to ensure that a rule does not cause a significant increase in false positives before it is fully deployed. Which strategy is most effective?

What is the purpose of automated response orchestration in cloud security?

Keep studying — Cloud Threat Detection and Response