Which factor is most important when prioritizing cloud vulnerabilities for remediation?

The number of vulnerabilities found

The exploitability and business impact of the vulnerability

A company has a legacy application running on a single VM in AWS. The application has a known vulnerability that cannot be patched because the vendor no longer provides updates. The application is critical to business operations and must remain available. What is the most appropriate remediation strategy?

Disable the application until a patch is available.

Replace the VM with a containerized version of the application.

Move the application to a different cloud provider.

Implement compensating controls, such as network isolation, strict IAM policies, and enhanced monitoring.

A security analyst discovers a critical vulnerability in a cloud application and needs to report it to the executive team, which is non-technical. The report should clearly communicate the risk and the required action. Which approach is most effective?

Provide a detailed technical description of the vulnerability and the exploit code

Explain the vulnerability in terms of potential business impact, such as data breach or financial loss, and recommend a timeline for remediation

Wait until the vulnerability is fully remediated before reporting it

Send a list of all vulnerabilities found, sorted by severity, without additional context

GIAC Cloud Threat Detection

Domain 3Objective 3

Cloud Vulnerability Analysis GCTD Practice Questions (Page 1)

Part of the Cloud Threat Detection and Response domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 4–7 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 1–5

1foundation · easy
Which factor is most important when prioritizing cloud vulnerabilities for remediation?
Select an answer first
2foundation · easy
Which of the following is a common vulnerability associated with cloud APIs that lack proper authentication or authorization checks?
Select an answer first
3expert · hard
A company has a legacy application running on a single VM in AWS. The application has a known vulnerability that cannot be patched because the vendor no longer provides updates. The application is critical to business operations and must remain available. What is the most appropriate remediation strategy?
Select an answer first
4foundation · easy
Which of the following tools is commonly used to scan container images for known vulnerabilities in a cloud environment?
Select an answer first
5application · medium
A security analyst discovers a critical vulnerability in a cloud application and needs to report it to the executive team, which is non-technical. The report should clearly communicate the risk and the required action. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Cloud Vulnerability Analysis GCTD Practice Questions (Page 1)

Questions 1–5

Which factor is most important when prioritizing cloud vulnerabilities for remediation?

Which of the following is a common vulnerability associated with cloud APIs that lack proper authentication or authorization checks?

Which of the following tools is commonly used to scan container images for known vulnerabilities in a cloud environment?

A security analyst discovers a critical vulnerability in a cloud application and needs to report it to the executive team, which is non-technical. The report should clearly communicate the risk and the required action. Which approach is most effective?

Keep studying — Cloud Threat Detection and Response