What is a primary objective of nation-state actors when targeting cloud environments?

Promoting a political cause through website defacement

Financial gain through ransomware

Espionage and intellectual property theft

Accidental exposure of data due to misconfiguration

A security team is evaluating CTI sources for their cloud environment. They need a source that provides real-time alerts about active attacks targeting cloud infrastructure. Which source is most appropriate?

A cloud provider's threat intelligence service that sends real-time alerts

A social media hashtag tracking cloud attacks

During incident response, a team identifies that a threat actor used a previously unknown technique to compromise a cloud workload. The team wants to use CTI to improve their response and future detection. Which action is most effective?

Reset all credentials and move on without further analysis

Document the technique and map it to MITRE ATT&CK for Cloud to identify detection gaps

Delete all logs related to the incident to prevent further exposure

Immediately block all traffic from the attacker's IP address

What is the primary purpose of cyber threat intelligence (CTI) in the context of cloud threat detection and response?

To provide actionable knowledge about threats that informs detection, response, and decision-making

To guarantee that no cloud security incident will ever occur

To automatically block all malicious IP addresses before they can reach cloud resources

To replace the need for traditional security monitoring and logging in cloud environments

A security analyst at a mid-sized company discovers a new phishing campaign that uses a legitimate cloud storage service to host malicious documents. The analyst wants to share this intelligence with other organizations to help them defend against the same campaign. Which action is most appropriate for responsible and effective threat intelligence sharing?

Share the IOCs and TTPs with an Information Sharing and Analysis Organization (ISAO) or sector-specific ISAC, following the traffic light protocol (TLP) for appropriate dissemination.

Publish the full details, including the exact URLs and file hashes, on a public blog to reach the widest audience.

Sell the intelligence to a commercial threat intelligence vendor to monetize the discovery.

Only share the intelligence internally within the company and do not disclose it externally to avoid legal liability.

GIAC Cloud Threat Detection

Domain 3Objective 2

Cyber Threat Intelligence for the Cloud GCTD Practice Questions (Page 6)

Part of the Cloud Threat Detection and Response domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 4–7 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

Questions 26–30

26foundation · easy
What is a primary objective of nation-state actors when targeting cloud environments?
Select an answer first
27application · medium
A security team is evaluating CTI sources for their cloud environment. They need a source that provides real-time alerts about active attacks targeting cloud infrastructure. Which source is most appropriate?
Select an answer first
28expert · hard
During incident response, a team identifies that a threat actor used a previously unknown technique to compromise a cloud workload. The team wants to use CTI to improve their response and future detection. Which action is most effective?
Select an answer first
29foundation · easy
What is the primary purpose of cyber threat intelligence (CTI) in the context of cloud threat detection and response?
Select an answer first
30application · medium
A security analyst at a mid-sized company discovers a new phishing campaign that uses a legitimate cloud storage service to host malicious documents. The analyst wants to share this intelligence with other organizations to help them defend against the same campaign. Which action is most appropriate for responsible and effective threat intelligence sharing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.