4.4 Explain the Creation and Configuration Process for Cloud Detection and Response (CDR) and Threat Management CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the key characteristic of a Behavioral IOC (BIOC) rule in CDR?

   • AIt aggregates multiple events from different sources to detect a threat
   • BIt uses statistical models to identify anomalies in network traffic
   • CIt detects threats based on behavioral patterns rather than static indicators
   • DIt matches events against a list of known malicious IP addresses
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst has created an automation playbook that quarantines a file when a detection rule fires. The analyst wants to ensure the playbook only runs for a specific detection rule, not for all rules. How should the analyst configure this?

   • ACreate a schedule that triggers the playbook
   • BManually run the playbook when the alert appears
   • CSet the playbook to run on all alerts
   • DAdd the playbook as an action in the specific detection rule
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of an action that an automation playbook in CDR might perform?

   • AUsing machine learning to score the risk of an event
   • BMatching a file hash against a threat intelligence feed
   • CCorrelating multiple events to identify a threat
   • DIsolating a compromised virtual machine
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security architect is designing a detection strategy for a multi-cloud environment. They need to detect a known APT group's C2 communication, which uses a specific domain, but also want to detect the group's lateral movement behavior, which involves unusual RDP connections. The architect wants to minimize false positives while ensuring both detections are effective. Which combination of rule types should they use?

   • AAnalytic rule for the C2 domain and a correlation rule for the RDP behavior
   • BIOC rule for the C2 domain and a BIOC rule for the RDP behavior
   • CBIOC rule for the C2 domain and an IOC rule for the RDP behavior
   • DCorrelation rule for the C2 domain and an analytic rule for the RDP behavior
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst at a financial firm needs to detect a known malware family that communicates with a specific command-and-control domain. The analyst has the domain's reputation data and wants to alert whenever any workload in the cloud environment attempts to resolve or connect to that domain. Which type of detection rule should the analyst create?

   • AAnalytic rule
   • BBehavioral IOC (BIOC) rule
   • CCorrelation rule
   • DIndicator of Compromise (IOC) rule
   Reveal Solution Discussion Select an answer first