A security team wants to improve their detection of cloud-based attacks by mapping their detection rules to MITRE ATT&CK for Cloud. They have a rule that detects the creation of access keys in AWS. Which MITRE ATT&CK technique is most directly associated with this detection?

Data Exfiltration Over Web Service (T1567)

A security team is building a CTI program and needs to select sources that provide timely and relevant intelligence for their cloud environment. They have a small team and limited time for analysis. Which source combination is most efficient for their needs?

Multiple open-source feeds that the team manually reviews and correlates.

A commercial threat intelligence platform that aggregates and correlates multiple feeds, including cloud-specific sources.

A single general-purpose feed that is easy to integrate but lacks cloud-specific context.

Only the cloud provider's security advisories, which are specific but may not cover all threats.

A security team is considering joining a cloud-focused threat intelligence sharing community. They are concerned about sharing sensitive information about their own environment. Which approach best balances the benefits of sharing with the need to protect sensitive details?

Do not share any information to avoid any risk of exposure.

Share only IOCs and TTPs, without any details about the organization's infrastructure or business context.

Share only aggregated statistics about attacks, without specific IOCs or TTPs.

Share full incident reports, including network diagrams and system configurations, to help others understand the attack.

How can CTI be used to enrich cloud incident response?

By guaranteeing that the incident will not recur

By preventing the need for forensic analysis

By automatically deleting all affected cloud resources

By providing context about the threat actor, their tactics, and potential impact

A company uses a cloud provider's serverless computing service. A security analyst discovers that a misconfigured function allowed an attacker to access sensitive data. The analyst wants to understand the root cause and prevent recurrence. Which aspect of the cloud threat landscape is most relevant?

Misconfiguration of cloud resources

GIAC Cloud Threat Detection

Domain 3Objective 2

Cyber Threat Intelligence for the Cloud GCTD Practice Questions (Page 10)

Part of the Cloud Threat Detection and Response domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 4–7 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

Questions 46–50

46expert · hard
A security team wants to improve their detection of cloud-based attacks by mapping their detection rules to MITRE ATT&CK for Cloud. They have a rule that detects the creation of access keys in AWS. Which MITRE ATT&CK technique is most directly associated with this detection?
Select an answer first
47application · medium
A security team is building a CTI program and needs to select sources that provide timely and relevant intelligence for their cloud environment. They have a small team and limited time for analysis. Which source combination is most efficient for their needs?
Select an answer first
48expert · hard
A security team is considering joining a cloud-focused threat intelligence sharing community. They are concerned about sharing sensitive information about their own environment. Which approach best balances the benefits of sharing with the need to protect sensitive details?
Select an answer first
49foundation · easy
How can CTI be used to enrich cloud incident response?
Select an answer first
50application · medium
A company uses a cloud provider's serverless computing service. A security analyst discovers that a misconfigured function allowed an attacker to access sensitive data. The analyst wants to understand the root cause and prevent recurrence. Which aspect of the cloud threat landscape is most relevant?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.