Which cloud-specific IOC might indicate that an attacker has gained access to a cloud account and is using its resources for cryptomining?

A reduction in storage consumption

An increase in idle time of virtual machines

A significant increase in compute resource usage

A security analyst notices that a cloud account is being used to launch a large number of virtual machines for cryptocurrency mining. The account was compromised via a phishing email. Which threat actor motivation is most likely?

State-sponsored disruption of critical infrastructure

Industrial espionage to steal trade secrets

Political activism to protest the company's policies

Financial gain through resource hijacking

A security analyst is creating a detection rule for a cloud environment. They want to detect an attacker who uses a compromised service account to access a cloud storage bucket and then exfiltrates data. Which combination of IOCs and TTPs should the rule focus on?

The source IP address of the service account, mapped to T1078 (Valid Accounts).

Unusual API calls to `GetObject` from a service account that typically does not access storage, mapped to T1530 (Data from Cloud Storage).

The size of the data transferred, mapped to T1048 (Exfiltration Over Alternative Protocol).

The time of day the access occurs, mapped to T1078 (Valid Accounts).

GIAC Cloud Threat Detection

Domain 3Objective 2

Cyber Threat Intelligence for the Cloud GCTD Practice Questions (Page 2)

Part of the Cloud Threat Detection and Response domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 4–7 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

Questions 6–10

6foundation · easy
Which cloud-specific IOC might indicate that an attacker has gained access to a cloud account and is using its resources for cryptomining?
Select an answer first
7application · medium
A security analyst notices that a cloud account is being used to launch a large number of virtual machines for cryptocurrency mining. The account was compromised via a phishing email. Which threat actor motivation is most likely?
Select an answer first
8application · medium
A security analyst is creating a detection rule for a cloud environment. They want to detect an attacker who uses a compromised service account to access a cloud storage bucket and then exfiltrates data. Which combination of IOCs and TTPs should the rule focus on?
Select an answer first
9foundation · easy
Which phase of the threat intelligence lifecycle involves converting raw data into a format that can be analyzed, such as normalizing logs or decoding files?
Select an answer first
10application · medium
A company uses a cloud provider's managed database service. A security analyst discovers that a vulnerability in a third-party library used by the application allowed an attacker to access the database. The analyst wants to understand who is responsible for patching the vulnerability. Which concept is most relevant?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Cyber Threat Intelligence for the Cloud GCTD Practice Questions (Page 2)

Questions 6–10

Which cloud-specific IOC might indicate that an attacker has gained access to a cloud account and is using its resources for cryptomining?

A security analyst notices that a cloud account is being used to launch a large number of virtual machines for cryptocurrency mining. The account was compromised via a phishing email. Which threat actor motivation is most likely?

A security analyst is creating a detection rule for a cloud environment. They want to detect an attacker who uses a compromised service account to access a cloud storage bucket and then exfiltrates data. Which combination of IOCs and TTPs should the rule focus on?

Which phase of the threat intelligence lifecycle involves converting raw data into a format that can be analyzed, such as normalizing logs or decoding files?

Keep studying — Cloud Threat Detection and Response