Cyber Threat Intelligence for the Cloud GCTD Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   In the threat intelligence lifecycle, which phase involves establishing requirements and defining the intelligence needs of the organization?

   • ADissemination
   • BDirection
   • CCollection
   • DProcessing
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security team is implementing a CTI program for their cloud environment. They have collected a large volume of raw logs and threat feeds. The team is now at the processing phase of the threat intelligence lifecycle. They need to ensure that the processed data is accurate and relevant for their cloud environment. Which action is most critical during this phase?

   • ADelete all data that does not match known IOCs
   • BDistribute the raw data to all security analysts immediately
   • CCollect additional raw data from more sources to increase volume
   • DNormalize and correlate the raw data to remove false positives and enrich it with context
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A cloud security team is establishing a CTI program. They have a limited budget and need to prioritize which threat intelligence feeds to integrate into their SIEM. They want to focus on actionable intelligence that directly improves detection of cloud-specific threats. Which approach best aligns with the threat intelligence lifecycle's direction and collection phases?

   • APurchase a threat intelligence platform that aggregates all available feeds and automatically blocks any IP that appears in any feed.
   • BRely solely on the cloud provider's built-in threat detection alerts and do not integrate external intelligence.
   • CSubscribe to a commercial feed that provides raw IP reputation lists and integrate them as watchlists in the SIEM.
   • DCollect open-source intelligence from cloud provider security blogs and vendor reports, then process and analyze it to extract relevant TTPs and IOCs for cloud environments.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security analyst is investigating an incident where a cloud account was used to launch a large number of instances that were then used to send spam emails. The analyst wants to identify the likely threat actor and their motivation. Which combination of actor and motivation is most likely?

   • AHacktivist using the instances to spread political messages via spam.
   • BInsider threat using the instances for personal email marketing.
   • CNation-state actor using the instances for espionage by sending phishing emails.
   • DFinancially motivated cybercriminal using the instances for spam campaigns to earn affiliate revenue.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security analyst is evaluating CTI sources for a cloud-focused intelligence program. They need intelligence that is timely, relevant to their cloud environment, and provides actionable IOCs and TTPs. Which source is most likely to meet these requirements?

   • AThe cloud provider's own threat intelligence reports and security advisories, which are specific to the services in use.
   • BA general-purpose threat intelligence feed that aggregates data from multiple industries.
   • COpen-source intelligence from social media and forums, which may contain early indicators but require significant processing.
   • DA commercial feed that provides only IP reputation scores without additional context.
   Reveal Solution Discussion Select an answer first