Cyber Threat Intelligence for the Cloud GCTD Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a common method for integrating CTI into a SIEM for cloud detection?

   • AReplacing the SIEM with a threat intelligence platform
   • BStoring threat intelligence only in spreadsheets
   • CDisabling all automated alerts to reduce noise
   • DIngesting threat intelligence feeds and correlating them with cloud logs
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security manager is explaining the value of CTI to the executive team after a cloud security incident. The incident involved a misconfigured database that was publicly accessible. The manager wants to emphasize how CTI could have helped prevent or detect this incident. Which statement best describes the role of CTI in this context?

   • ACTI provides a list of all misconfigurations in the cloud environment, so the team can fix them proactively.
   • BCTI helps the team understand common attack patterns against misconfigured cloud resources, enabling them to prioritize monitoring and alerting for those patterns.
   • CCTI is only useful after an incident to identify the attacker's identity.
   • DCTI automatically patches misconfigured resources before they are exploited.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst is reviewing a detection rule that flags any API call to `ec2:RunInstances` in a particular AWS account. The rule generates many false positives because the development team frequently creates instances. The analyst wants to use MITRE ATT&CK for Cloud to improve the rule. Which approach is most effective?

   • AChange the rule to alert only when the instance is created with a public IP address.
   • BUse a commercial threat intelligence feed to block any IP that has been associated with `RunInstances` in the past.
   • CAdd context to the rule, such as correlating `RunInstances` with other techniques like `CreateRole` or unusual source IPs, and map the rule to relevant ATT&CK techniques.
   • DRemove the rule entirely because the API call is legitimate in this environment.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During an incident response, a team identifies that an attacker used a valid but compromised IAM role to create a new user and then used that user to access a database. The team wants to use CTI to prioritize remediation. Which action is most effective?

   • ASearch for other IOCs such as unusual API calls or access patterns from the same actor, and map the TTPs to MITRE ATT&CK to identify all potential persistence mechanisms.
   • BImmediately delete the compromised IAM role and the created user, then rotate all associated credentials.
   • CReview the cloud provider's threat intelligence feed for any alerts related to the IAM role.
   • DChange the database password and enable multi-factor authentication for all users.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security architect is designing a detection strategy for a multi-cloud environment (AWS and Azure). The team has limited resources and must prioritize which threats to monitor. They have identified three major risks: misconfigured storage, compromised credentials, and supply chain attacks via third-party libraries. The architect wants to use CTI to decide where to focus. Which approach is most balanced?

   • APrioritize supply chain attacks because they are the hardest to detect and have the highest impact.
   • BFocus exclusively on misconfigured storage because it is the most common cloud threat.
   • CRely on the cloud providers' default security alerts and do not invest in additional CTI integration.
   • DImplement detection for all three risks equally, using cloud-native tools and CTI feeds to cover each area.
   Reveal Solution Discussion Select an answer first