A security analyst notices a series of failed login attempts to an AWS account, followed by a successful login from a new IP address. The account then created several IAM users and attached administrative policies. Which cloud-specific IOC is most indicative of a potential compromise?

The time of day when the successful login occurred

A successful login from a new IP address after multiple failures

The creation of multiple IAM users with administrative policies

The failed login attempts originating from a single IP address

A security operations team wants to integrate CTI into their cloud-native detection pipeline. They have a SIEM that ingests AWS CloudTrail and Azure Activity Logs. The team wants to automatically block IP addresses associated with known malicious actors. Which approach best achieves this?

Manually review CTI reports and update firewall rules on a weekly basis

Use a SIEM integration that ingests STIX/TAXII feeds and triggers automated response playbooks to update security group rules

Subscribe to a threat intelligence email list and manually add IPs to a blocklist

Configure the SIEM to alert on all failed login attempts and block the source IP after three failures

Why is threat intelligence sharing important within cloud communities?

It is required by law in all countries

It allows organizations to benefit from collective knowledge and early warnings about emerging threats

It guarantees that all members will be immune to attacks

It replaces the need for internal security monitoring

A security analyst observes a series of failed login attempts to a cloud management console from a range of IP addresses, followed by a successful login from a new IP that then immediately creates a large number of virtual machines. The analyst suspects a specific threat actor type. Which actor profile and motivation best fits this behavior?

Insider threat using the VMs for personal projects.

Nation-state actor conducting espionage by using the VMs to stage data exfiltration.

Financially motivated cybercriminal aiming to use the compute resources for cryptocurrency mining.

Hacktivist aiming to use the VMs to launch a denial-of-service attack.

Which of the following is an example of a cloud-specific indicator of compromise (IOC)?

A sudden spike in API calls from a single user account

A change in the local system's registry key

An unusual DNS query from a workstation

A new file appearing in the Windows Startup folder

GIAC Cloud Threat Detection

Domain 3Objective 2

Cyber Threat Intelligence for the Cloud GCTD Practice Questions (Page 11)

Part of the Cloud Threat Detection and Response domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 4–7 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

Questions 51–55

51application · medium
A security analyst notices a series of failed login attempts to an AWS account, followed by a successful login from a new IP address. The account then created several IAM users and attached administrative policies. Which cloud-specific IOC is most indicative of a potential compromise?
Select an answer first
52application · medium
A security operations team wants to integrate CTI into their cloud-native detection pipeline. They have a SIEM that ingests AWS CloudTrail and Azure Activity Logs. The team wants to automatically block IP addresses associated with known malicious actors. Which approach best achieves this?
Select an answer first
53foundation · easy
Why is threat intelligence sharing important within cloud communities?
Select an answer first
54application · medium
A security analyst observes a series of failed login attempts to a cloud management console from a range of IP addresses, followed by a successful login from a new IP that then immediately creates a large number of virtual machines. The analyst suspects a specific threat actor type. Which actor profile and motivation best fits this behavior?
Select an answer first
55foundation · easy
Which of the following is an example of a cloud-specific indicator of compromise (IOC)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.