Cyber Threat Intelligence for the Cloud GCTD Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team is reviewing a recent incident where an attacker exploited a vulnerability in a third-party library used by a cloud application. The attacker gained access to the application's cloud environment and moved laterally. Which aspect of the cloud threat landscape does this incident primarily illustrate?

   • AInsider threat, because the attacker had legitimate access to the library.
   • BShared responsibility model, because the cloud provider is responsible for patching the library.
   • CSupply chain risk, because the vulnerability originated from a third-party component.
   • DMisconfiguration, because the application was not properly configured.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security operations center (SOC) uses a SIEM to monitor their cloud environment. They want to integrate CTI feeds to automatically block malicious IPs. However, they are concerned about false positives blocking legitimate traffic. Which approach best balances automation and risk?

   • AManually review every indicator before adding it to the blocklist
   • BBlock all IPs that appear in any CTI feed for at least 24 hours
   • CAutomatically block all IPs from the CTI feed without review
   • DUse a risk-scoring mechanism that considers the reputation and confidence of the CTI feed before blocking
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which statement best describes the role of CTI in cloud threat detection and response?

   • AIt provides context that helps security teams prioritize and respond to threats more effectively
   • BIt is primarily used to satisfy regulatory compliance requirements
   • CIt is only useful for large enterprises with dedicated threat intelligence teams
   • DIt replaces the need for human analysis in security operations centers
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which framework is commonly used to map and categorize cloud-specific tactics, techniques, and procedures (TTPs)?

   • AMITRE ATT&CK for Cloud
   • BNIST Cybersecurity Framework
   • CISO 27001
   • DOWASP Top 10
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A threat intelligence team is implementing the intelligence lifecycle for a cloud-focused program. They have collected a large volume of data from various sources, including cloud provider logs, OSINT, and commercial feeds. The team is struggling with the processing and analysis phases because the data is noisy and contains many false positives. Which action best addresses this challenge?

   • ALimit collection to only commercial feeds, which are already processed and analyzed.
   • BDisseminate the raw data to all stakeholders and let them interpret it independently.
   • CSkip the processing phase and directly use the raw data in the SIEM to avoid delays.
   • DAutomate the processing phase using machine learning to filter out noise, then have analysts validate and enrich the remaining indicators.
   Reveal Solution Discussion Select an answer first