During incident response, a team discovers that a threat actor used a specific technique to abuse a misconfigured AWS S3 bucket. The team wants to use CTI to enhance their response and prevent recurrence. Which action is most aligned with using CTI effectively?

Reset all IAM credentials and enable MFA for all users

Consult MITRE ATT&CK for Cloud to map the technique and identify related TTPs and detection opportunities

Search internal logs for the same S3 bucket access pattern and block the attacker's IP

Immediately delete the S3 bucket to prevent further abuse

In the shared responsibility model, which security aspect is typically the responsibility of the cloud customer?

Patching the underlying hypervisor

Configuration of cloud resources and access policies

Network infrastructure maintenance

Physical security of data center facilities

A security analyst observes a series of API calls from a single IP address that enumerate IAM roles and then attempt to assume an administrative role. The activity occurs outside business hours and originates from a country where the company has no operations. Which threat actor profile is most consistent with this behavior?

A financially motivated actor attempting to gain persistent access for data exfiltration or ransomware

A hacktivist group seeking to deface the company's website

A disgruntled employee testing security controls

A nation-state actor conducting espionage for intellectual property theft

A security analyst notices a service account in AWS CloudTrail making repeated `ec2:RunInstances` calls from the same source IP, each followed by `iam:CreateRole` and `iam:AttachRolePolicy` calls. The pattern repeats every few minutes across multiple regions. The analyst wants to classify this as a cloud-specific IOC and map it to a TTP for further investigation. Which classification and mapping is most appropriate?

Normal administrative behavior; map to T1078.004 (Valid Accounts: Cloud Accounts) only, as the service account is authorized to create resources.

Anomalous API call sequence indicating credential misuse; map to T1078.004 (Valid Accounts: Cloud Accounts) and T1578.002 (Modify Cloud Compute Infrastructure) in MITRE ATT&CK.

Data exfiltration attempt; map to T1530 (Data from Cloud Storage) because the role creation is likely to access storage buckets.

Resource exhaustion attack; map to T1499.001 (Resource Exhaustion: Cloud) because the repeated instance creation could deplete quotas.

GIAC Cloud Threat Detection

Domain 3Objective 2

Cyber Threat Intelligence for the Cloud GCTD Practice Questions (Page 5)

Part of the Cloud Threat Detection and Response domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 4–7 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

Questions 21–25

21application · medium
During incident response, a team discovers that a threat actor used a specific technique to abuse a misconfigured AWS S3 bucket. The team wants to use CTI to enhance their response and prevent recurrence. Which action is most aligned with using CTI effectively?
Select an answer first
22foundation · easy
In the shared responsibility model, which security aspect is typically the responsibility of the cloud customer?
Select an answer first
23application · medium
A security analyst observes a series of API calls from a single IP address that enumerate IAM roles and then attempt to assume an administrative role. The activity occurs outside business hours and originates from a country where the company has no operations. Which threat actor profile is most consistent with this behavior?
Select an answer first
24application · medium
A security analyst notices a service account in AWS CloudTrail making repeated `ec2:RunInstances` calls from the same source IP, each followed by `iam:CreateRole` and `iam:AttachRolePolicy` calls. The pattern repeats every few minutes across multiple regions. The analyst wants to classify this as a cloud-specific IOC and map it to a TTP for further investigation. Which classification and mapping is most appropriate?
Select an answer first
25foundation · easy
Which threat actor type is most commonly associated with financially motivated attacks targeting cloud environments, such as deploying ransomware or cryptomining?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.

Cyber Threat Intelligence for the Cloud GCTD Practice Questions (Page 5)

Questions 21–25

During incident response, a team discovers that a threat actor used a specific technique to abuse a misconfigured AWS S3 bucket. The team wants to use CTI to enhance their response and prevent recurrence. Which action is most aligned with using CTI effectively?

In the shared responsibility model, which security aspect is typically the responsibility of the cloud customer?

Which threat actor type is most commonly associated with financially motivated attacks targeting cloud environments, such as deploying ransomware or cryptomining?

Keep studying — Cloud Threat Detection and Response