Cyber Threat Intelligence for the Cloud GCTD Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which of the following is a common cloud-specific threat that arises from customer actions?

   • APhysical theft of servers
   • BHypervisor-level attacks
   • CMisconfiguration of cloud storage buckets
   • DUndersea cable damage
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A cloud security team wants to integrate CTI into their SIEM to detect cloud-specific threats. They have a list of IOCs from a recent threat report, including suspicious API call patterns and IP addresses. Which integration approach is most effective for reducing false positives while maintaining detection coverage?

   • AUse the IOCs to enrich alerts and correlate them with behavioral analytics, such as unusual API call sequences or access from new locations.
   • BCreate alert rules that trigger on any match of the IP addresses from the IOC list, regardless of context.
   • CAutomatically block any user or resource that matches an IOC from the list.
   • DManually review each IOC against the SIEM logs without creating automated rules.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   During a cloud incident response, the team discovers that an attacker used a valid session token to access a cloud environment. The token was obtained from a phishing email. The team wants to use CTI to improve future detection. Which action is most aligned with using CTI for incident response?

   • AAdd the phishing email's sender address and subject line to the blocklist and move on.
   • BAnalyze the phishing campaign's TTPs and map them to MITRE ATT&CK, then create detection rules for similar token theft patterns.
   • CImmediately revoke all session tokens and require multi-factor authentication for all users.
   • DShare the phishing email with the community but do not analyze the TTPs.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security manager is justifying the investment in a CTI program to the board. The board asks how CTI will improve the company's cloud security posture. Which response best explains the value of CTI?

   • ACTI will automatically prevent all cloud attacks by blocking malicious IPs and domains.
   • BCTI will reduce the cloud bill by identifying unused resources.
   • CCTI provides actionable insights into threat actors' TTPs, enabling the team to prioritize monitoring and response efforts.
   • DCTI is required by compliance regulations and therefore must be implemented.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A cloud security team is building a CTI program and wants to include a source that provides timely, actionable information about active cloud threats. They have limited budget and need a source that can be integrated into their SIEM. Which source is most appropriate?

   • AA free open-source intelligence feed that provides STIX-formatted indicators
   • BA colleague's personal blog with detailed analysis of cloud threats
   • CA social media account that posts about recent cloud attacks
   • DA paid vendor report that is published quarterly
   Reveal Solution Discussion Select an answer first