Cyber Threat Intelligence for the Cloud GCTD Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst at a multi-cloud company is evaluating CTI feeds to improve detection of credential-stuffing attacks against their AWS and Azure environments. The analyst needs a feed that provides timely, actionable indicators that can be directly consumed by their SIEM for automated alerting. Which type of CTI feed should the analyst prioritize?

   • AAn open-source blog post from a security researcher detailing a recent cloud credential-stuffing campaign
   • BA government advisory PDF describing general best practices for cloud authentication
   • CA vendor's annual cloud security threat report summarizing trends and statistics
   • DA commercial feed that provides STIX/TAXII-formatted indicators of compromised cloud credentials and malicious IPs
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a key advantage of using cloud provider threat intelligence feeds?

   • AThey eliminate the need for other CTI sources
   • BThey are always free and available to the public
   • CThey provide detailed information about on-premises threats
   • DThey provide visibility into threats targeting the provider's infrastructure and customers
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a key benefit of integrating CTI into automated response workflows in the cloud?

   • AIt enables immediate, consistent responses to known threats without manual intervention
   • BIt eliminates the need for security analysts
   • CIt removes the need for logging and monitoring
   • DIt guarantees that no false positives will occur
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an example of open-source intelligence (OSINT) that can be used as a CTI source for cloud threats?

   • AA confidential report from a government intelligence agency
   • BInternal incident response logs from your own organization
   • CA proprietary threat feed from a commercial vendor
   • DA blog post analyzing a recent cloud ransomware campaign
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A cloud security team is considering joining a threat intelligence sharing community. They want to share IOCs with other organizations but are concerned about exposing sensitive information about their own environment. Which practice best addresses this concern?

   • AAvoid sharing any IOCs to prevent any risk of exposure
   • BShare all IOCs including internal IP addresses and account names
   • CShare only IOCs that are already publicly known
   • DShare IOCs using a trusted platform that supports anonymization and data sanitization
   Reveal Solution Discussion Select an answer first