A company is ingesting logs from AWS CloudTrail, Azure Active Directory, and Google Workspace into a central SIEM. The security team wants to write detection rules that can query across all three sources using a common schema. Which approach is most effective?

Write separate rules for each source and manually correlate the results in a separate dashboard.

Use the SIEM's built-in normalization features to map fields from each source to a common schema, and write rules against the normalized fields.

Store the logs in separate tables and use a SQL join to combine them on the user ID field for each query.

Convert all logs to JSON format and store them in a single table, using the JSON structure as the common schema.

Which practice is essential for implementing detection as code?

Manually deploying detection rules to production

Writing detection rules in YAML only

Storing detection rules in a spreadsheet

Using a version control system for detection rules

A company uses Azure Sentinel and wants to ingest AWS CloudTrail logs. The logs are stored in an S3 bucket. Which method should they use to get the logs into Sentinel for analysis?

Use a third-party script that copies logs to Azure Blob Storage and then manually import them into Sentinel.

Configure AWS to send CloudTrail logs directly to Sentinel's REST API without a connector.

Use the AWS S3 connector in Sentinel to ingest CloudTrail logs, which normalizes them into the CommonSecurityLog or AWSCloudTrail table.

Manually download the logs and upload them to Sentinel via the Azure portal.

GIAC Cloud Threat Detection

Domain 3Objective 1

Automated Detection and Response GCTD Practice Questions (Page 9)

Part of the Cloud Threat Detection and Response domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 4–7 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

10concepts

Questions 41–43

41application · medium
A company is ingesting logs from AWS CloudTrail, Azure Active Directory, and Google Workspace into a central SIEM. The security team wants to write detection rules that can query across all three sources using a common schema. Which approach is most effective?
Select an answer first
42foundation · easy
Which practice is essential for implementing detection as code?
Select an answer first
43application · medium
A company uses Azure Sentinel and wants to ingest AWS CloudTrail logs. The logs are stored in an S3 bucket. Which method should they use to get the logs into Sentinel for analysis?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Automated Detection and Response GCTD Practice Questions (Page 9)

Questions 41–43

A company is ingesting logs from AWS CloudTrail, Azure Active Directory, and Google Workspace into a central SIEM. The security team wants to write detection rules that can query across all three sources using a common schema. Which approach is most effective?

Which practice is essential for implementing detection as code?

A company uses Azure Sentinel and wants to ingest AWS CloudTrail logs. The logs are stored in an S3 bucket. Which method should they use to get the logs into Sentinel for analysis?

Keep studying — Cloud Threat Detection and Response